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To: Counterterrorism 


From: . b3 -2 
Re: , Date 01/23/2002 b7E -3 


System Data: 
Hardware/configuration (CPU): Various 
Operating System: Various a 
Software: Various wt 


Security Features: 
Security Software Installed: x yes (identify firewalls, router) 
Logon Warning Banner: x yes no 


INTRUSION INFORMATION 
Access for intrusion: x Internet connection 0 dial-up number [J LAN (insider) 
If Internet: Internet address: TBD 
Network name: TBD 


Method: 

The individual who caused the intrusion first performed a port scan on their 
system identifying the vunerable ports. Once he identified the vunerable ports he performed an 
exploit on the ports gaining access the the outer network. Once inside he was able to obtain 
employees userids' and social security numbers. He activated guessed the password of a former 
employee's userid and gained access to the internal network. Once inside he left a password 
behind so that he could access the system at a later date. He also left his name behind in another 
system as a type of fingerprint that he had been there. The hacker, Adrian Lamo, held a press 
conference and admitted to committing the hack. 


Path of intrusion: TBD 
addresses: 1. TBD 
country: 


Subject: AD 
Age: 21 Race: W. 
Sex: _ Male Education: __unknown- well kndwn hacker 
Alias(s): Motive: Bragging rights 
and theft of userids and passwords 
Group Affiliation: 


Employer: 
Known Accomplices: 


ipment used: myo 
ME vacdwere/eonfiguration : ‘ 
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x “From: c 
Re: , Date 01/23/2002 Bed 


To: Counterterrorism 


Operating System: 
Software: 
Impact: 
Compromise of classified information: O yes x no 
Estimated number of computers affected: 4 
Estimated dollar loss to date: over $5000 
Category of Crime: 
Impairment: Theft of Information: 

% Malicious code inserted Classified information compromised 
Denial of service x Unclassified information compromised 
Destruction of information/software x Passwords obtained 

x Modification of information/software Computer processing time obtained 

Telephone services obtained 
Application software obtained 
Operating software obtained 
Intrusion: 


x Unauthorized access 
Exceeding authorized access 


REMARKS be -4 
Have spoken wit be the Southern District of New York and complaintant. b7c -4 
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Leia, 05:48 pet 9/12/02 -0500, Re: Information on ids 


To! LNG)" 
From: 


Subject: Re: Information on ids 
Ce: 

Boo: 

Attached: 


b7c -6 
Could you determine for me whether any other IDs were created on the Times account between 2/17 and 
2/28? I'd like to see a list of them if you can do it. 


lil probably have you kill any that i cannot readily identify. 
Thank you. 
bic -2 


At05:43 PM 3/12/02 -0500, you wrote: 


Here is the information that you requested: 


lsage started on the days they were established: a oe . 


2002-02-19 10:00:18.953 


2002-02-18 04:57:46.430 


Let me know if you need anything else. 


| 


Phone: 
Fax: 212-309-7835 
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bic - 
FEDERAL BUREAU OF INVESTIGATION 


Precedence: ROUTINE Date: 03/06/2002 
To: New York 


From: New York 
Squad C-37 


b7¢e -1 
: b3 -2 


Title: LAMO, ADRIAN 
Synopsis: Request to open sub-files and change of title. 


Details: Writer requests the following sub-files to be opened in 
above referenced case: 


Also, please open the following Sub files: 


b3 -2 
bIE -3| 


Writer requests Title of Case be changed to : 


ADRIAN LAMO 

New York Times-Victim; 

Computer Intrusion-Information Systems 
O00: NY 
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"Rey, 0828-2000) 


Precedence: PRIORITY Date: 03/14/2002 


To: All Field Offices Attn: NIPC SSA 


From: New York 
Squad C-37 
Contact: SA 


Approved By: 


Title: ADRIAN LAMO; 
New York Times-Victim; 
Computer Intrusion; 
OO: NY 


Synopsis: Canvass all FBI Offices for positive information 
regarding ADRIAN LAMO. 


Details: In February 2002, LAMO discovered several misconfigured 
proxy servers acting as doorways between the public Internet and 
the New York Times’ private intranet. LAMO utilized the proxy 
servers to gain access to the New York Times network. Once on 
the network, LAMO cracked a password for a userid with supervisor 
rights. Utilizing this userid he was able to broaden his access 
as well as perform certain functions within the network. LAMO 
had access to individuals names and Social Security Numbers. 

LAMO informed The New York Times of the security vulnerability 
through SECURITYPOCUS.COM. 


iO has committed com tér intrusiefis into-.several 
other coyporations such as WO) COM, MICROSOFT AQi” EXCL @HOME 
0. LAMO uses a “Pr HUuHcer” Eo e-Typernet “for 
servers that are miSConfigured. mce he Obtains this 
inférmation, he configures his browser to appear and utilize the 
proxy server as his own. Once the computer intrusion occurs, 
LAMO searches the network to determine if there are any other 
vulnerabilities and in the case of: The New York Times, left a 
backdoor so that he could enter at another time undetected. 


Hach time LAMO commits a computer intrusion on a high 
profile organization he reports the vunerability and intrusion to 
the media causing a distrust of the company’s clients. The above 
mentioned corporations have lost significant money and trust of 
their clients. 
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To: All Field Offices From: New York 
a (OE 


who was 
nai=security 


LAMO has ties to former hacker 


arrested by the FBI for computer intrusiori/iat¥ 
charges. 


The New York Office and the Southern District of New 
York are currently investigating LAMO and his computer 
intrusions. 


Descriptive Data: 


Main Subject" 
Name -.<" 


“A 


gf Middle: 

re Race: 
Y Sex: 
i SOC: 

Address - 
House #: 
Street Name: 
city: 

State: 
Postal Code: 94102 


1230 
Market Street, #106 
San Francisco 


b6 -3 
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To: All Field Offices From: New York 


b7E -3 


LEAD (s): 
Set Lead 1: 


ALL RECEIVING OFFICES 


It is requested to query logical sources and report only 
positive intelligence regarding known or potential actions of 


ADRIAN MANO. Positive intelligence should be directed to SA 
b6 -1 


bic -1 
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FEDERAL BUREAU OF INVESTIGATION 


b6é -1 
b7c -1 


Precedence: ROUTINE Date: 03/14/2002 
To: New York 


From: New York 
Squad C-37 


" Drafted By: 


Case ID #: 


Your Times- -Victim; 
Cony my er Intrusion; 


Details: In February 2002, LAMO discovered several misconfigured 
proxy servers acting as doorways between the public Internet and 
the New York Times’ private intranet. LAMO utilized the proxy 
servers to gain access to the New York Times’ network. Once on 
the network, LAMO cracked a password for a userid with supervisor 
rights. Utilizing this userid he was able to broaden his access 
as well as perform certain functions within the network. LAMO 
had access to individuals’ names and Social Security Numbers. 
LAMO informed The New York Times of the security vulnerability 


through ECURTTYPOCUS - COM. 
ie cad 


-4 


LAMO has committed computer intrusions into several 
other corporations such as WORLDC Lee BACT TECHOME 
and YAHOO, LAMO uses a “Proxy H 


> é THteEnee=for 
proxy“géFvers that are misconfigured. Once he obtains this 
information, he configures his browser to appear and utilize the 
proxy server as his own. Once the computer intrusion occurs, 
LAMO searches the network to determine if there are any other 
vulnerabilities and in the case of The New York Times, left a 
backdoor go that he could enter at another time undetected. 


Each time LAMO commits a computer intrusion on a high 
profile organization he reports the venerability and intrusion to 
the media causing a distrust of the company’s clients. The above 
mentioned corporations have lost significant money and trust of 
their clients. 
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To: -, New York 
-. °Re: (Bamttig) 03/07/2002 ron 3 
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LAMO has ties to former hacker | who was 
arrested by the FBI for computer intrusion/national security 


charges. 


iter contacted Assistant United States Attorney 
SDNY who concurred with the investigation. 


FBI(19-cv-1495)-41 
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Precedence: ROUTINE Date: 03/07/2002 


SA 


From: New York bic -1 
Squad C-37 
approved By, [TJ 


Case ID #: [sd ( Beredkerig) - PIE 3 
Title: LAMO, ADRIAN 

Synopsis: Backgound information on subject and associates. 

Enclosures: Copy of article ‘He Hacks by Day, , Squats by night’. 

Details: On 03/06/2002, SA requested the writer to . be -1,-4 


conduct a logical search on Adrina Lamo. Mr. Lamo has a history b7c -1,-4 
of intruding into corporate systems: Yahoo (09/01); Worldcom 


(10/01) and The New York Times (03/02). According to ACS no 
other field office has initiated a case on this matter. Hence, 
SA provided IRS LJ with an article found in Wired News 


(http: //wired.com/news/0,1294,50811,00.html) as a starting source 
of information on Adrian Lamo. 


referenced article b i i i b6 -5 

(Adrian Lamo (2 Po bic -5 

Ls) DIE -2 
provided the following details on the above 

bIE -2 
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Precedence: PRIORITY Date: 04/09/2002 


fo: New York | | 


Squad C-37 b6 -1 
From: Chicago bIC -1 
Squad IPC 


Contact: SA —— 
Approved By: 


Drafted By: jt 


. b3 -2 


Title: ADRIAN LAMO; 
NEW YORK TIMES-VICTIM; 
COMPUTER INTRUSION; : 

0O:NY i 


Synopsis: Lead Covered for Chicago Division. 


Details: As per telephone conversataion between writer and SA 

on 04/04/2002, members of Chicago's Computer Intrusion 
Squad (IPC) were canvassed regarding the referenced EC with 
negative results. ACS was also canvassed for any related Chicago 
Division cases with negative results. 


b6 -1 
bic -1 


Chicago considers this lead covered. 


had 


may 07 2002 
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Squad C-37 
be -1 
From: Washington Field b7c -1 


NS-18 / Northern Virginia Resident Agenc 
Contact: [od 


Approved By: [keg lwty- 
oearted ny: [saa ih 


Case ID ‘{___-— (Sendtiig) 

b3 -2 

Title: ADRIAN LAMO; bIE -3 
New York Times-Victim; 


Computer Intrusion; 
OO: NY 


Synopsis: Lead covered at WFO.” 


Administrative: Reference March 22, 2002 email sent to SSA be -1 


Details: Referenced communication requested WFO/NIPC query 
logical sources and report only positive intelligence 
regarding known or potential actions of ADRIAN LAMO. 


ssaT sens ssaf vin bend 
email, information_advising that Ameritech/SBC was a victim of bre -1 
Adrian Lamo. ssa(____ J additionally stated that he believes 
that Ameritech/SBC spoke with FBI Dallas concerning this. 


All other logical sources were queried, however, no 
positive information was provided. 


Based on the above investigation, and unless advised 
by New York Division, WFO considers this lead covered. No 
further investigation regarding this lead will be performed. Any 


ap this matter.should be directed to SA 
at 


sp021071.ec 
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y To: > Washington Field . 
Re: 04/16/2002 
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Set Lead 1: 
NEW YORK 
AT NEW YORK, NY 


Read and clear. 
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sp021071.ec 2 
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FEDERAL BUREAU OF INVESTIGATION 


Precedence: ROUTINE Date: 03/08/2002 
To: New York 


From: New York 
C-37: 


Contacts [] oe. 
b7c -1 
Approved By: ——= 


Drafted By: & 
: b3 -2 


Title: 


ynop ° P b7e -1 


Intern ess. 
et eee bIE -1,-4 


Details: On 03/08/02 writer provided sa(_—™—~—~—CSCSC Witt 


to the Internet through the 


saLswass able to begin an investigation on subject es, 
ADRIAN LAMO. LAMO has comitted computer intrusions into several DIE -1 


corporations such as WORLDCOM, MICROSOFT, AOL and Eee beers 
LAMO posts his "accomplishments" to the 


SECURITYFOCUS.COM web site. To help §. nga 
i writer will continue to provide use ee 
+ 


eetnee e a) 


Wipe el 
B cae 
oO Fat(19-071495)53 


Automated Serial Permanent Charge~-Out 
FD-5a (1-5-94) 


Date: 05/20/02 Time: 09:18 © 


Description of Document: 


Type : FD302 

Date : 03/19/02 

To : WASHINGTON FIELD 

From : NEW YORK 

Topic: ON 3-19-02, A COMMUNICATION VIA FAX WAS RECEIVED IN RESPONSE 


Reason for Permanent Charge-Out: 


WRONG FILE NUMBER 
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FEDERAL BUREAU OF INVESTIGATION 


: Date of transcription 04/19/2002 


Individual, who has not agreed to testify, provided the 
following information: 


Investigation on 04/06/2002 a 


File # 


wy gat nth 


43,02 041, wT 


This document contains neither recommendations nor eonstusions of the FBI. tis the prpedy of the FBT and is loaned to your agen 
= it-and its contents-are=not-to:be:distributed- outside -your-agency. poneswre.t 
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Precedence: ROUTINE Date: 04/19/2002 


To: New York Attn: Squad_C-37 
: SA 


From: Oklahoma City 
Squad 8 


approved By: [7 


Title: ADRIAN LAMO; 
New York Times - Victim; 
Computer Intrusion; 
00 :NY 


Synopsis: To cover lead. 


Enclosure(s): 1) One original and one copy of a source 302 
referencing Lamo; 


Cd "2) One IA envelope containing = 


Details: In response to NY Division lead, OC Division queried 
all sources for information on Lamo. The results of the inquiry 
are located in the enclosures. 


OC Division considers this lead completed. 


Gada eco 
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bic -1 
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bIE -3 
b7D -1 


To: >, Oklahoma City 
Re: 04/19/2002 


LEAD (s): 


Set Lead 1: (Adm) 
NEW YORK 


AT NEW YORK, NY 


Read ‘and clear. 
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FEDERAL BUREAU OF INVESTIGATION 
Date of transcription 05/09 / 2002 
be -2 
RES TON: eae, Was tele y pre 
-erviewing “After being advised as to the 
interviewing agent and the purpose of the 
rovided the following information: 
is aware of an individual by the name of ADRIAN 
y acked into the computer network of WORLDCOM in 
“November 2001. 
sce rr DCOM' s Public Relations Department was contacted by 6 -2,-3 
Secu s, and informed that LAMO had hacked =o “5 74 


‘and his engineers were able to confirm 
into their network. The engineers, 

:  unternal Da along with 
a member of WOREDCONTE Sgail Department arranged a 
telephong’ call betweesi themselves and LAMO™ GWided WORLDCOM 
with internal screen captures that he had obtali: when he had 
hacked into their network. The screen captures” co i 

information pertaining to their internal Heb-sites| stated 
that LAMO gained unauthorized access to their networks fo obtain 
the screen captures and any other information. 


“into” their networ! 


LAMO told WORLDCOM employee's that he gained access to 
their internal network through a misconfigured proxy server. LAMO 
exploited Port 80 on the proxy server and once he gained access he 
was able to view confidential information on WORLDCOM's internal 
network. LAMO admitted to the WORLDCOM employees that he accessed 
their network from KINKOS. LAMO informed WORLDCOM about the 
intrusions months after he had first intruded. The engineers 
immediately reconfigured the proxy server to prevent against future 
exploits of this kind. 


[ __ssia that WORLDCOM suffered a significant be -2 
financial loss due to the unauthorized intrusion by LAMO. Ler! pic ~2 
believes that LAMO was looking for publicity not monetary 

for his hacking. The publicity that WORLDCOM received because of 

the intrusion was detrimental to WORLDCOM's business. 


Investigation on 03/14/02 at New York, NY (telephonically) 
b6 -1 
File # Date dictated 03/17/2002 prc -1 
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stated that a WORLDCOM investigator was ili 
wit nm the past, the investigator had arreste 


in California for hacking into unauthorized systems. 
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Attached is a letter received in response to a subpoena sent 
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Attached is a letter received in response to a subpoena sent 
to b3 -1 
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FEDERAL BUREAU OF INVESTIGATION 


Date of transcription §_ 03/27/2002 


Publishing Systems, THE 
r can peepone 


was ° interviewe 


Also present during the interview was 
ae THE NEW YORK TIMES. Affter being advised as to the 


identities_of the interviewing age ts and the purpose of the 
interview, __—jprovided the foflowing information: 
trusion into THE NEW 


[lis aware~of~th: 
YORK TIMES intranet by QDRTAN believes that 


gained i aE acceéssrt6 rotwa intranet on or around February 


Sp 


14, 2002 along with fmembers of her staff reviewdéd the 
logs of théir wep servers and/proxy servers and from thi 


the unauthorized entries made by LAMO. At this tine{ _lis 
unable to determine if LAMO downloaded any information from their 
intranet. 


[ |provided the interviewing agents with a copy of ane 
emails and analysi prepared regarding the computer 
intrusion of LAMO. stated that the logs and database will 
be secured by THE TIMES. . 
Investigation on 03/26/2002 at New York, NY : b6 -1 
bic 
File # Date dictated 03/27/2002 b3 -2 
bIE -3 
vy SA 
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@ ALL INFORM By 
EEREIN IT = 
Sere J2-25-2010 é0red | en i} 
be 2 
[_]os:55 pra 2/28/02 -0500, web logs TC -2 
X-Sendery 
X-Mailer: QUALCOMM Windows Eudora Version 4.3.2 
Date: Thu, 28 Feb 2002 17:55:35 -0500 
To; 
From: 
Subject web logs 
bé -2 
ind found indications that our ET [omens 
He did bIE -1 
lere's the summary of hits on the technews server. 
imes were originally logged in Greenwich Mean Time; I've converted them to Eastern by 
subtracting five hours. 
Thursday, Feb. 14 58 hits between 1:36 a.m. and 2:24 a.m. 
Wednesday, Feb. 20 326 hits between 7:44 p.m. and 10:41 p.m. 
Thursday, Feb. 21 95 hits between 10:06 a.m. and 10:55 a.m. 
Monday, Feb. 25 98 hits between 3:00 p.m. and 3:45 p.m. 
Tuesday, Feb. 26 30 hits between 8:00 a.m. and 8:15 a.m. 
A‘hit" is either a "get" or a "post". A "get" is a request for information, or aread. A "post" is a ae 
write’, orf Joss. there are 441 gets and 166 posts. Re Bans 


Ie = = Imes 


Seventh Floor, 229 West 43rd Street 
New York, NY 10036-3959 


Phone:[7 Pager: LC] Fax: 212-556-1636 


b6 -2 
Printed for 1 


bic -2 
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= AM 3/26/02 -0500, FW: Change in Stafflist 


erry 
From: E hws Co ak UND 
Tox Ob Ve ha BAS 
Subject: FW: Change in Stafflist } io 
Date: Tue, 26 Mar 2002 10:59:33 -0500 Jn ppl 2 J 
X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2011.0) OLY ® he 
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 aca 
Importance: Normal N Sgn 
-----Original Messace----- 
From 
Sent: Wednesday, February 20, 2002 8:10 PM 
T eee aces 
Subject: Change in Stams: 
ee 
—~———__ 
Get than marl fle 
Printed foi 4 
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‘ FEDERAL BUREAU OF INVESTIGATION 
Date of transcription 03/27/2002 
Public Relations, THE hoe, 
NEW YORK Slow SOG, SULECL: NEW NOL NY LOU se teleptione 
number | was, interviewed i L . 
Also présént_ during the interview was 
C1 THE NEW YORK TIMES-—BFES being SavVIsed GS to 
the identities oF the interviewing agents and the purpose of the 
i i provided the following information: 
On, Febuuanmy..26.,.20, as connected by ne 3 


Of “SECURITYFOCUS , informed THE NEW YORK TIMES 


y i that an intrusion had occurred 8 -2:-3 
so she contacte When she contacted he told her Gy. 2ro3 
that the hacker, ADRIAN /LAMO Rad gained access into their intranet q 
and that LAMO wouTd=1ee problem if THE NEW YORK TIMES 
contacted him directly was provided LAMO's cell phone 
number (415) 505-4225. never spoke with LAMO directly. 


. J dreces ied a telephone call from the WASHINGTON POST 
and MSNBC com and was ‘informed that LAMO had provided them with 
screen shots of their intranet and she was asked to comment. One 
of the reporters who called her told her that LAMO informed them 
that he had been in their intranet for 10 days prior to informing 
them of the intrusion. 


mented thal peg gatted her yesterday "for an pee 5 
update". old her tha’ e heard a rumor from TECHTV that e wr 
THE NEW YORK TIMES was going to prosecute LAMO for his unauthorized 


intrusion. wanted to know iff had reported it as a 
criminal act to € Federal Bureau of Investigation. 


commented that LAMO ruined the reputation of their 
OPED page. 


Investigation on 03/26/2002. at _New York, NY 
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[ ___provided the interviewing agents with various 
paperwork regarding her discussions and investigation into the 
unauthorized intrusion by LAMO. . 
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TELHERTT. 


e 


02/26/2002 01:11 PM 


To: 
ce: 


Subject: Reporter call re: alleged security breach w/NYT Co. intranet 


i received a call trom[ reporter with Security Focus, an online publication. 
{www.securityfocus.com 


Leia he was contacted by a hacker of "known reliability" who said he was able to gain access 
to The New York Times Company's intranet (and extranet, it seems). 


According to the reporter, this hacker-said he was able to download the social security numbers of 
all Times employees, as well as personal files/info on 3,000 op-ed contributors. He also accessed 
credit card information for home delivery subscribers. 


He said he was able to get thru via an open proxy server. 


Please give me a call to let me know 

1) if this is possible 

2) if we can track access records to see if in fact our files were accessed by this person and 
3) how we'd like to respond. 


The reporter's on deadiine for today and has asked us to comment. Supposedly this is a "friendly" 
hacker who in the past has alerted companies to these types of security issues and helped resolve 
them (not as a paid consultant but te be "helpful" according to the reporter}. 


thanks! 


b6 -2 
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PR 


The New York Times — 
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be -1, -2 
bic -1, -2 
02/26/2002 02:01 PM 
To: 
cect 
Subject: Re: IP addresses for alleged security breach -- NYT intranet 
b6 -2 
Lo Jhow has this information and is examining her Proxy server for more information. pic -2 
| To: 
02/26/02 01:29 PM ° 
Ce 
Subject: IP addresses for alleged security breach -- NYT intranet 
| called back to clarify where this information was accessed so we could nail this down. Reporter 
also gave me the IP addresses for the proxy servers that were accessed, 
-- | think it's limited te the NYT newspaper -- the social security numbers were for newspaper 
employees and op-ed columnists, 
--['m not sure who serves the home delivery Web site, but the hacker gave the reporter a log that 
had a chronological file of when print subscribers had stopped & started delivery, or complained etc. 
here are the IP addresses: 
DIE -1 
lll call to followup. thanks. 
b6 -2 
bic -2 
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BT TTUit 


02/26/2002 01:11 PM 


To: 
ce: 


FBI(19-cv-1495)-93 * 


NRRL 


02/26/2002 03:15 PM 
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bIC -1, -2,-3 
To: 
co: 


Subject: 


I called back the reporter. __]to find out his deadline. He is filing by 4 PM EST today, so we'll 
need to draft a holding statement by then. 


LC “hiso said the hacker was fine with us to contacting him; described him as an unusual, 
“friendly hacker" who wants to help. I'm not sure how you've handled this in the past but here's 
his info: 

Adrian Lamo 415-505-4225 


I did a Googie search on Lamo and turned up recent, similar articles by the same publication & 
reporter of today's query, FYI: 


Yahoo! News hacked 

Hacker tinkers with news articles undetected. 
By Kevin Poulsen 
http://online.seourityfocus.com/news/254. 
Sep 18 2001 4:25PM PT 


in a development that exposes grave risks of news manipulation in a time of crisis, a hacker 
demonstrated Tuesday that 

he could rewrite the text of Yahoo! News articles at will, apparently using nothing more than a 
web browser and an 

easily-obtained Internet address. 


Yahoo! News, which learned of the hack from SecurityFocus, says it has closed the security hole 
that allowed . 

20-year-oid hacker Adrian Lamo to access the portal's web-based production tools Tuesday 
morning, and modify an 

August 23rd news story about Dmitry Sklyarov, a Russian computer programmer facing federal 
criminal charges under . 

the controversial Digital Millennium Copyright Act (DMCA). 


Lamo's Adventures in WorldCom 
The helpful hacker strikes again, this time finding a route into the communications company's 
private Web, 

then telling its security staff all about it. Who is Adrian Lamo, why does he do this, and would 
his life be the 

same if Kinkos kicked him out? 
By Kevin Poulsen 
Dec 5 2001 10:46AM PT | 
http://online.securityfocus.com/news/296 a. 
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TATE $2-15-2019 


FIED 


ed 


02/26/2002 04:19 PM 
To: 


ee: 


Subject: response to first press inquiry 


am drafting the response to the second query; will circulate shortly. 


“--- Forwarded by[ ido 02/26/2002 04:13 PM nnnnennnnnnen—e 


02/26/2002 04:07 PM 


ce: 


Subject: NYT issue 


—| 


| realize you're on deadline for 4 PM EST so here's a statement: 


“The New York Times Company takes the seourity of its network very seriously and we are actively 
investigating a potential security breach. Based on the results of this investigation we will take 
appropriate steps to ensure the security of our network." 


R 
The New York Times Company 


b6é -1, -2 
BIC! ALy =2 


b6 -2,-3 
b7C -2,-3 


b6 -2,-3 
b7C -2,-3 


FBI(19-cv-1495)-95 


« : LL INFIRMATIGN CONTAINE> 


TUSSI 


bé -1, -2 
bic -1, -2 
02/26/2002 04:16 PM 
cc: 
Subject: second press query: NYT intranet exposure 
. . .. 5 . be -2 
jet's talk more about pulling thi pic 2 
bIUE -1 


This reporter is fiting tonight too, and word gets around quickly in the hacker community. Don't 
want more folks hitting the sites. 


If it's not secure, and personal info is out there, we may want to err on the side of caution until 
we're sure, 


~-- Forwarded by lon 02/26/2002 04:09 PM --—---—~ pee 2d 
lon 02/26/2002 03:57:28 PM 


ce: 


Subject NYT intranet exposure 


b6 -2 
LC] bic -2 
A source of mine tells me that the NYT Corporate Intranet 


was exposed via a rogue proxy on the company's netblock. 
He has sent me detailed screen shots and information. 


I'm writing to solicit any general comments the company 
is prepared to make on this development. I have also included 
some specific questions below, if you'd care to address them. 


Has the NYT disabled access to the sites in question, and 
had anyone there previously expressed concern that such 
an exposure might come to pass? 


How long has remote access been available through this 
network? Did the Times take any steps in particular to prevent 
the sort of high-profile defacement left in 1998 by the group 
“Hackers for Girlies"? 


Thanks in advance for your help. This is for a story I'm filing 
this afternoon. I'll call you as well. 


Sincerely, 


FBI(19-cv-1495)-96 


02/26/2002 07:32 PM bic -1, 


To: 
cc: 
Subject: thoughts about calling the hacker tomorrow? WorldCom did... 


here's the excerpt from the article | sent earlier. WorldCom worked actively with “the kid” to fix the 
wholes...he also contact them through SecurityFocus.com. 


! think @ techie to techie call would be fine, he seems pretty helpful from this article. 


And working with him would be a way te minimize the situation like WorldCom did below. let me 
know what you want to do... 


http://online.securityfocus.com/news/296 
Lamo's Adventures in WorldCom 


- The Helpful Hacker 

“Vint Cerf recently did a public service announcement in which, generally speaking, the message 
was it would be really 

great if the hacker community went back to its roots," says WorldCom spokesperson Jennifer 
Baker. “I guess that from 

@ general industry standpoint, Adrian seems to be doing just that... At that end of the day, what 
he did wasn't 

destructive or harmful.” 


Over a month after the Kinkos visit, Lamo has come clean with WorldCom, and the company is 
grateful. The hacker 

contacted the communications leviathan through SecurityFocus on Friday. Saturday morning, just 
as he crashed after i 

an all-night hacking session on “an unrelated project," his cell phone rang. There were three 
WorldCom managers on 

the line, wondering of it was true that Lamo had cracked their global corporate intranet, and 
what they needed to do to 

fix it. 


“| made it clear very quickly that all | was interested in doing was make it as positive an 
experience as possible for 

everyone," says Lamo. True to his word, the hacker would spend the rest of the weekend on 
conference calls and in 

email, bleary brieting the company on his months of illicit exploration. On Tuesday, the 
WorldCom turned to Lamo to 

give them a final bill of health. After a scan of their address space, he pronounced that 
WorldCom had successfully 

closed the proxy hole. 


"What we discovered when we investigated Adrian's issues, was that there was a router with an 
inappropriate filter on it," 

says Baker. “In the end it was a human error, and we're really happy that he brought it to our 
attention... We really 
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appreciate his efforts to work with us” 


That instant willingness to cooperate, even to sign a non-disclosure agreement, with no strings 
attached is part of what's S 

kept Lamo out of legal trouble, for what are indisputably violations of federal computer crime 
law. In May, when the 2 

hacker used an open proxy to crack ailing Excite@Home's internal Web, adding himself to the 
corporate directory and 

finding a route to millions of subscribers’ records, he walked into the company's Redwood City, 
Calif. headquarters to 

brief network administrators in person, and he didn't leave before helping them plug the hole. 
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02/26/2002 07:37 PM 


To: 

cc: 

Subject: some hints to the WorldCom hacking that might apply to us 

from that same article. _http:/fonline.securityfocus.com/news/296 


did he do the same on NYT Co's intranet? 


The Problem with Proxies 

As he has with other networks, Lamo found the keys to WorldCom's kingdom in open Internet 
proxy servers. In normal 

operation, a proxy server is a dedicated machine that sits between a local network and the 
outside world, passing 

internal surfers’ Web requests out to the Internet, often caching the results to speed up 
subsequent visits to the same 

URL. 


But it's easy and common for administrators to inadvertently misconfigure proxy servers, 
allowing anyone on the Internet 

to channel through them. Sometimes companies and organizations even unknowingly run 
proxies. Hackers and 

Privacy-conscious netizens catalog these open proxies, using them to anonymize their surfing. 
Lamo has perfected a 

different use: jumping through them to pose as a node ona company's internal network. 


Using a common hacker tool called "Proxy Hunter," Lamo scanned WorldCom's corporate 
Internet address space, and 

quickly found five open proxies -- one of them hiding in plain site at wireless.wcom.com. From 
there, he needed only to 

configure his browser to use one of the proxies, and he could surf WorldCom's private network 
as an employee. 


Once inside, he found other layers of security protecting various intranet sites from employees 
who might exceed their 

authorized access. But after a couple of months of sporadic exploring, Lamo has made 
substantial inroads. He can use 

WerldCom human resources system to list names and matching social security numbers for any 
or all of the company's 

86,000 employees. With this information, all he needs is a birth date (he swears by 
anybirthday.com) and-he can reset 

an employee's password and access his or her payroll records, including information like their 
salary, emergency 

contacts, and direct deposit instructions, complete with bank account numbers. He could even 
modify the employee's 

direct deposit bank account, and divert a paycheck to his own account, if he wanted to. "A lot of 
people would be willing 

to blow town for a couple hundred thousand dollars,” says Lamo. 
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AOL's 


He has some access to customer records, too, primarily subscribers to 
WorldCom's data services. He can browse notes and circuit diagrams for 


new T1 cross border link between its Virginia offices and AOL Mexico, and a 
detailed engineering order for a connection between the 
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e.gov showed evidence that an individual had gained access to a proxy server on 
he irregular traffic. They contacted 


the vendor of the proxy server and through cooperation with the vendor; within three (3) weeks they 


were able to configure the proxy server correctly. 


The network team monitored the network to observe if there was any irregular activity. They 
a proxy server sending outbound HTTP traffic from www. senate.gov. The network team isolated 


noticed 


this outbound traffic to a particular proxy server on their network, The 
The packets showed outbound URL requests. 


activity from the proxy server. 
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The proxy server 


transmitting the URL requests was outside their DMZ. The URL jespsacouah ihe proxy server were 
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Date of transcription 06/27/2003 


Senate Legal Counsel, 642 Senate Hart Building, Washington, DC 20510, 


of employment. Also present during the 
andl] After being 
advised as to the identity of the interviewing agent and the purpose of the interview, they provided the 
following information: bo -2, -5 
DIC =2 55 
In early November 2002, the Intrusion Detection System (IDS) logs of the network supporting 
the website wwnw.senate. gov showed evidence that an individual had gained access to a proxy server on 
their network. The network team implemented safeguards against the irregular traffic. They contacted 
the vendor of the proxy server and through cooperation with the vendor; within three (3) weeks they 
were able to configure the proxy server correctly. 


The network team monitored the network to observe if there was any irregular activity. They 
noticed a proxy server sending outbound HTTP traffic from www.senate.gov. The network team isolated 
this outbound traffic to a particular proxy server on their network. The IDS captured the packets of 
activity from the proxy server. The packets showed outbound URL requests. The proxy server 
transmitting the URL requests was outside their DMZ. The URL requests — the proxy server were 


coming from more than one (1) source Internet Protocol (IP) address. did a whois lockup 
on the IP addresses but does not remember the results of the search. me: 3 
Cc =: 


The network team created a database to track the events/reports of the incident. The network 
team also preserved the IDS logs pertaining to the incident. Lo stated that nothing in their 
network was changed as a result of the vulnerability and to date has not discovered any backdoor 
programs on their network, stated that their was no financial loss to the Senate pertaining to 
this incident. 


£ stated that she would provide the interviewing agent with the IP addresses contained 
in the IDS pertaining to this vulnerability. 
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DMV history and internet checks on the following individuals. All the results are attached. 
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Full Name: 
Last Name: 
First Name: 


Business Address: L pr S$ fi 


DOB: 
SSN: 
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* Hacker according t [Lamo If! 


* Need GJ subpoena 
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e & 
| Buited States Bistrict Court 


SOUTHERN DISTRICT OF NEW YORK 


Grand Jury Subpoena 0108 


TO: : 
EEREIN 13 bo -l, 
TATE 92-34-2010 bIC -1, 
GREETINGS: 


WE COMMAND YOU that all and singular business and excuses being laid aside, you appear and attend 
before the GRAND JURY of the people of the United States for the Southern District of New York, at the 
United States Courthouse, Foley Square (40 Centre Street), Room 209, in the Borough of Manhattan, City 
of New York, New York, in the Southern District of New York, at the following date, time and place: 


to testify and give evidence in regard to an alleged violation of: 


Title 18, United States Code, Section 1030 


and not to depart the Grand Jury without leave thereof, or of the United States Attorney, and that you bring 
with you and produce at the above time and place the following: 


SEE ATTACHED RIDER 


NB: PERSONAL APPEARANCE IS REQUIRED. Please produce the requesied documents on b6 -1 
or before the return date to Special Agen{__———S—S—S—«d#Fedder.al Bureau of Investigation, 9,7 _} 
26 Federal Plaza, New York, New York 10278, telephone mumber ————__—faesimile < 
number (212) 384-4660, , 


Failure to attend and produce any items hereby demanded will constitute contemptof court and will subject ° 
you to civil sanctions and criminal penalties, in addition to other penalties of the Law. 


DATED: New York, New York 


bs) =1 
JAMES B. COMEY 2B is b6 -4 
United States Attorney for the oa 4 b7c -4 


Southern District of New York Q Vvlloal OM Mallend 5 


Assistant United States Attorney Telephone: 
One St. Andrew’s Plaza * 212) 637-2487 
New York, New York 10007 
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First Name: 


Home Address: 


Business: 


L__]ame 


FBI(19-cv-1495)-116 


‘se Fi 

b6 -1 
af WL 2908 2.1 
cK 


i b3 -2 
RO HITE -3 


FBI(19-cv-1495)-125 


ALL INFIRMATISN ©: 


HEREIN IS UNSLA 
+ TATE 92-14-2010 3 
Rev. 631.2003) 


FEDERAL BUREAU OF INVESTIGATION 


Precedence: ROUTINE Date: 07/29/2003 


To: New York Attn: Press Office 


From: New York 
Squad DT-5 


approved By: [J be <1 


Drafted By: slf pe > 


Case ID aL sd (Pen&dfng) DIE -3 


Title: ADRIAN LAMO; 
New York Times-Victim; 
Computer Intrusion; 
00: NY 


Synopsis: Information for the press office regarding ADRIAN LAMO 
and his possible arrest 


Enclosure(s): Copy of article from sfweekty~co ecent 
interview of the subject ADRIAN 


Description: ADRIAN LAMO is a twenty two (22) year old male who 
commits unauthorized computer intrusions into major corporations. 
LAMO is labeled in the media as the "homeless hacker". He 
considers himself a "white hat hacker". Investigation by the New 
York Office has revealed that LAMO is a "black hat hacker", an 
individual who breaks into a computer system with the purpose of 
inflicting damage or stealing data. Each time LAMO hacks a major 
corporation he alerts friends in the media first and has them 
contact the victim for comment. 


In September 2001, LAMO hacked YAHOO! and rewrote the 
text of a YAHOO! News article. LAMO gained access through the b6 -5 
portal's web-based production tools and modified a news story 6 -S 
about DMITRY SKLYAROV, a Russian computer programmer facing b7c -S 
federal criminal charges. LAMO used a free internet connection 
at KINKOS to commit the hack. each 
after being contacted b who 
was contégted by LAM’ Iby the 
FBI forlibonmitt ig Uriauthortae: 


Beat ye tenn 


computer intrusions. 
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“To: New York From: New York 


Re: [__] 07/29/2003 bTE ~3 


In 2001, LAMO contacted the reporter, _] 
to inform him that he had gained 

unauthorized access into a MICROSOFT customer service database. 
LAMO had gained access to MICROSOFT's database is September 2001 . 
but choose not to disclose his access until October 2001. LAMO b6é —-5 
utilized a vulnerability in MICROSOFT's network that allowed an b7C -5 
unpublished Internet Protocol (IP) address to be entered into a 
web browser. The IP address provided access to recor: of people 
who had bought products and services from MICROSOFT. 
contacted MICROSOFT to ask them for a comment for the story he 
was writing about the hack. This was the first instance, 


MICROSOFT learned of pal R T confirmed the hack 

2 eed Seseried the 

incident as "an error that led to a breach of privacy, against ‘ 
our privacy policy". 


LAMO contacted the reporter,L____] 

to inform him that he had gained 
unauthorized access into MCI WORLDCOM's internal network. LAMO 
gained access to WORLDCOM's internal network in October 2001 but 
choose not to disclose his access until December 2001. LAMO bb -5 
provided internal screen captures to WORLDCOM to prove he was the ~ 
hacker. The screen captures from WORLDCOM's internal network bic -5 
state, "Not to be reproduced in any manner or disclosed to 
unauthorized individuals". LAMO gained access to WORLDCOM's 
internal network using a free internet connection at KINKOS. 
LAMO exploited a vulnerability in a WORLDCOM proxy server to gain 


unauthorized acc ir network. After committing the hack 
and reporting it LAMO commented "The downside is, I'm 
running, out of major US Corporations". Also, one of LAMO's 


prized possessions is a screen capture of WORLDCOM's stock price 
falling after he announced he had hacked the company. 


2002, LAMO contacted the reporter,[ ids 

to inform him that he had gained 
unauthorized access into SBC COMMUNICATIONS. LAMO gained access 
to SBC COMMUNICATIONS network in December 2001 but choose not to b6 -5 
disclose his access until February 2002. LAMO utilized an « 
exploit to gain access to SBC's internal network. LAMO used a bIC -S 
free internet connection at KINKO's to perform the hack. LAMO 
gained access to usernames, passwords, telephone numbers, 
addresses and other sensitive customer information. 


In February 2002, LAMO discovered several misconfigured 
proxy servers acting as doorways between the public Internet and 
private intranet. LAMO contacted of 
o inform him that he had gained unauthorized 
access into The NEW YORK TIMES intranet. LAMO utilized the proxy 
servers to gain access to the NEW YORK TIMES network. Once on 


2 
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To: New York From: New York b3 -2 
Re: _——— 07/29/2003 b7E -3 


the network, LAMO cracked a password for a userid with supervisor 
rights. Utilizing this userid he was able to broaden his access 
as well as perform certain functions within the network. LAMO 
created four (4) Lexis/Nexus accounts off of the NEW YORK TIMES 
intranet and utilized these accounts for himself and/or friends 
to run over 3,000 searches of individuals, address and/or court 
documents. 


LAMO has committed other computer intrusions into 
several other corporations such as AOL and EXCITE@HOME. Each 
time LAMO commits a computer intrusion on a high profile 
organization he reports the vulnerability and intrusion to the 
media causing a distrust of the company's clients. The above 
mentioned corporations have lost significant money and trust of 
their clients. 


In the enclosed San Francisco Weekly article, dated 
April 16, 2003, LAMO states "he is preparing to announce, in a 
few days, weeks or months -~- whenever he decides the time is 
right -- his biggest hack yet. On the record, he defines his 
target as a "“critical-infrastructure-related company"; off the 
record, he exhibits ample evidence of his repeated incursions 
into the corporations internal’ system." NYO believes that LAMO 
is a threat, to the infrastructure of the United States. 


The NYO along with the Southern District of New York 

(SDNY) are currently completing a complaint charging LAMO with 

his unauthorized access into WORLDCOM, NEW YORK TIMES, 

LEXIS/NEXUS, SBC COMMUNICATIONS and MICROSOFT. The NYO and the “ 

SDNY will have the complaint completed on July 30, 2003. bo -3, -5 

bTC: =3, 045 

LAMO is reports to be homeless and usually stays with 

friends or in hostels for lodging. LAMO makes money in the 

computer security field whe is, celi_ phone bill goes 

to residence at 

eeps in contact with well known hackers 


Investigation by the NYO has revealed that LAMO will be 
attending the annual hacker conference, DEF CON, in Las Vegas, 
Nevada from August 1-3, 2003. Four (4) agents from the NYO will 
be attending the conference with the purpose of arresting LAMO. 


Due to the high publicity LAMO brings to all his 
hacking activity and the hack of the New York Times, it is 
believed that the arrest of LAMO will be intensely covered by the 
media. ‘ 
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The SDNY and the New York Times will be preparing press 
releases when the arrest of LAMO is affected. Writer will be 
obtaining a copy of the SDNY press release. 
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A Duty to Hack 


Adrian Lamo, the 22-year-old "homeless hacker” 
famous for raiding New York Times computers, 
pursues his vision of public service by cracking 
another major corporate network. It's a crime, of 
course. It's also what he was born to do. 


BY MATT PALMQUIST 
matt.palmauist@sfweekly.com 
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ABOUT US 

CAREERS 


"Tell me the truth,” says Adrian 
Lamo, ducking inte a public restroom 
in the Embarcadero Center on a chilly 
March evening. “I jook like death, 
don't I?" 


Well, he doesn't look good. Lamo, 
who turned 22 a few days ago, didn’t 
get any sleep last night; he says he 
was “in transit," a fact to which his 
wrinkled cargo pants and rumpled 
brown jacket can piainly attest. His 
shoulders, as slight and bony as the 
rest of his frame, sag when he peers 
at his reflection in the scuffed mirror. 
"Yep," Lamo sighs, dropping his 
frayed backpack on the sink and 
turning on the faucet. "I look like 
death." Dark circles bloom below his 
warm hazel eyes, his lids droop, and 
whenever he isn't blinking, which isn't 
often, his pupils swim beneath a 
glassy sheen. Black and green spots 
mottle his yellow teeth; dirt crusts 
the edges of his ears. As he splashes 
water through his cropped brown 
hair, Lamo watches some of the color 
seep back into his face, whose angelic 
features appear pallid and ghostly at 
the best of times. "I'm feeling faint," 
he says, his dry, nasal voice 
stumbling over a mild stammer, his 
face rippling from the occasional tic. 
Ever since an amphetamine overdose 
last year, Lamo says, he’s apt to start 
convulsing if he goes too long without 


"Some days I have time 
to do things,” says Lamo. 
"Other days are just a 
series of efforts to find 
out where I'm going to 
sleep that night.” 


this week in NEWS ; 


From the Week of Wednesday, April 16, 
2003 


Matt Smith 

Remembrance of a War 
Past 

An unfond look back at 
Freedom Toast, TV jingoes, 
and a pro-war bully called 
Tony Hall 


Night Crawler 

Girls Wrestling in Jell-O 
While Bikers Howl 

What'd you expect on "Road 
Rash" night at Jezebel's 
Joint? 


Bedford: 
415-64 
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food or sleep. "I think I shouid stop 

by Carl's Jr. and get something to Dog Bites 

eat.” Culture Klatech 

When the Burning Man folks 
met the Air Force guys, the 


On his way out of the bathroom, desert camping tips flew 


Lamo nods his head at a nearby door, vette 
unmarked and anonymous, "Most of eters n 
the telephone switches for the RTECS 
Embarcadero are in there," he says, @ eek of Apr 26 

glint returning to his eye, the merest . . 
smile spreading across his cracked, thin lips. Then his cell pnone 
peals, and it takes Lamo a few heartbeats to identify the number of 
the incoming call. "My attorney," he sighs, before answering his 
phone in the kind of crisp, authoritative monotone you'd expect from 
one of the most celebrated and controversial hackers in the worid: 
"Lamo here." 


If you type the address 

www.sfweekly.. com /Examples/FileLibrary/: /Fites/y0.txt into your 
Internet browser, you'll see the following message, in plain black text 
on a white background: "Confidential to Matt Palmquist: Sorry I never 
really got back to you when you emailed. Give me a ring! -- Adrian 
Lamo." . 


Reaching Adrian Lamo is not particularly difficult. His cell phone 
number is 505-HACK. (“Everyone assumes there was some 
wrongdoing involved,” he says of obtaining the number, “but like with 
so many things, all you have to do is ask.") His e-mail address is 
adrian@adrian.ora, which you can locate with ease on Lamo's very 
own Web site (http://adrian.adrian.org). He admits he's not much at 
Web design, and his home page, whose header says "Faith manages," 
is certainly stark: Other than a blurred, pixelated image of Lamo in 
the upper right-hand corner, the only thing to look at is a verse, 
pointed and trenchant, from the Bob Dylan song “Idiot Wind": “People 
see me all the time, they just can't remember how to act/ Their minds 
are filled with big ideas, images, and distorted facts/ Even you, 
yesterday, you had to ask me where it was at/ I couldn't believe, after 
all these years, you didn't know me any better than that." 


In other words, though it's not hard to get in touch with Lamo 
(pronounced Lah-mo), it's considerably harder to get to know him -~ 
and perhaps hardest still to actually meet him. "Who is this?" he asks 
when I call him one day in early 2003. "Oh, I thought you were a 
collection agency." 


We'd been exchanging e-malis and phone messages for almost a 
year, ever since Lamo grabbed headlines around the world by hacking 
into the New York Times and pilfering, among other things, Social 
Security numbers, editing notes, and reimbursement figures for 
several of the Times’ more high-profile op-ed contributors, among 
them William F. Buckley Jr., Robert Redford, and former President 
Jimmy Carter. Media reports about the incident were, on the whoie, 
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brief and bemused (“All the News That's Fit to Hack," chortied the 
New York Post) and absent all but the most basic details about the 
young man who could, if he so wished, ring up Warren Beatty or Rush 
Limbaugh at home. The basic details: In the past few years this so- 
called "homeless hacker," a drifter who rides Greyhound cross- 
country and crashes in abandoned buildings or on friends’ couches, 
has trolled, undetected, through the innards of corporate giants like 
America Online, Yahoo! (where he edited himself into news stories), 
the now-defunct Excite@Home, the now-bankrupt WorldCom, and, 
most recently, the Times. And he did all this using Internet Explorer, 
usually from a computer at a Kinko's. His methods are refreshingly 
low-tech -- he often exploits open proxy servers, which, after 
configuring a Web browser properly, can act as doorways between 
the public Internet and a corporation's private computer network -- 
and he always teils companies how to close the holes he's found. 
Lamo's willingness to hefp the companies he hacks is part of his 
charm, and aiso part of the reason ne has so far avoided prosecution. 
(Drifting around the country helps, too.) 


Tepe 


"th the computer underground, he's very well-regarded," says Ed 
Skoudis, a vice president at the computer security company 
Predictive Systems and author of the anti-intrusion book Counter- 
Hack, "He's sincere, passionate, smart, with a good track record. 
Getting in and getting out without getting busted -- wow. And the 
thing that stands out about Adrian is that he's very open about the 
fact he's breaking the law. I don't want to get into his head, but he 
seems to think he's OK because he follows the spirit, if not the letter, 
of the law. And you know what?" Skoudis gives a smail chuckle. 
“Maybe there is some validity in the way Adrian does his thing, 
because his targets don’t seem to disagree.” 


That could change soon, however, and Lamo knows it. As it happens, 
one of the reasons I have such a hard time getting into Lamo's head, 
or even getting him on the phone, is because he's been preparing to 
announce, in a few days, weeks, or months -- whenever he decides 
the time is right -- his biggest hack yet. On the record, he defines his 
target as a “critical-infrastructure-related company"; off the record, 
he exhibits ample evidence of his repeated incurstons into the 
corporation's internal system -- incursions that are almost bound to 
be extremely embarrassing to the firm. He admits giving considerable 
thought to the company's reputation for aggressively pursuing 
hackers, and has been lining up fallback plans -- asylum in a foreign 
country, hiding in the Deep South -- in case the company fives up to 
its reputation. “in terms of my persona! sense of the intrusion and 
what it affects, I see this as more epic than anything I've worked on 
in the past," Lamo says, his clipped, halting words staggering out like 
text across a screen. "There's a sense of rightness about it. I believe 
it's broader in scope, but it also has more potential to go terribly 
south.” 


So why do it? That's what I'm dying to ask him, and because San 
Francisco is one of the few cities Lamo comes close to calling home 
(his parents live outside Sacramento), he generally spends some 
portion of his winter and spring in the Bay Area. But I'm not at alt 
surprised to hear, when I call him up, that he's still on the road. In 
fact, as we chat, Lamo is walking 20 minutes to the nearest wireless 
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Internet connection because, alas, the glue that binds his modem has 
melted from the heat of his laptop. "It's like I've always said, "If 
everyone had to walk 20 minutes to find an Internet connection, 
content on the Web would be so much better,'* Lamo jokes through 
the static of a fading cell-phone signal. 


We agree to postpone our chat again, until he's a bit more settled. 
"Stay out of trouble," he says before signing off. "Don't do anything I 
wouldn't do." 


Adrian Lamo doesn't know if the Pacific Bell Network Operations 
Center has moved out of a particular building on Second Street, but 
the last time he checked, the combination for the center's electronic 
door lock was still 55755. 


After more than a year, I finally meet Lamo face to face on Presidents 
Day. He's staying outside Sacramento, and he agrees to hop on the 
bus and meet me at a coffee shop near the capital, if I'm willing to 
make the drive out from San Francisco. It's a hazy, chilled afternoon - 
- Lamo describes himself as "nocturnal," and you can’t expect to 
catch him before 2 or 3 p.m. -- and the dusty, leaf-blown streets 
surrounding the Greyhound termina! downtown are largely deserted. 
Lamo shows up a half-hour late; he missed his scheduled bus, he 
explains, because he forgot his cell phone and had to retrieve it. He’s 
wearing a biack buttoned shirt, khakt pants, and sturdy brown boots, 
and his gaze is both intense and friendly, although he never, ever, 
asks questions and doesn't answer al! that are posed to him, Within 
minutes, he's tapping away at a black laptop, signing on (somehow) 
to a wireless connection. "I couldn't find any immediate reference to 
Matt Palmaquist in the San Francisco Bay Area outside of articles," 
Lamo says, “so ..." He turns his screen so I can take a peek at some 
of the, ahem, research he's turned up. "T'm happy to report," he says 
cheerfully, "that your account is in good standing." 


Although he conducted much of the work behind his most famous 
hacks at different Kinko's copy shops throughout downtown San 
Francisco, Lamo now prefers a wireless connection, so he can go 
online outdoors, on the steps of buildings, whenever the mood strikes 
him. Some bums in Philadelphia, he says, know him as Hackin' Man. 
"There's nothing like having the guy who was bellowing about Jesus 
at the top of his lungs five minutes ago check his Hotmail account 
from your Paim Top," Lamo says with a grin, sipping from a cup of 
coffee. "I five for unusual situations, improbabie things that wouldn't 
happen to anyone else." ‘ 


He's lived through plenty of those: His parents, who work in video 
production and as English-Spanish transiators, moved around a Sot 
when Lamo was a kid. He was born in Boston, and he spent much of 
his early life in Massachusetts and the Washington, D.C., area. "I like 
to say I was raised by a band of wandering gypsies, but that just 
wouldn't be factual," says Lamo. "My upbringing was not transient in 
that sense. We had a roof over our heads -- I was always cared for 
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well." The family spent a few years in Lamo's father's native 

| Colombia, then returned to the United States when Lamo's younger 
brother was born prematurely and needed medical attention here. His 
parents settled in the Bay Area in time for Adrian to start high school; 
he never finished. Following three unsuccessful stints at San 

Francisco schools (where, to no one's great surprise, he had some 
problems with authority), Lamo opted to get a GED instead. By this 
time he was 17, his parents had moved to Sacramento, and he'd 
decided to remain behind on the streets of San Francisco. 


Adrian's parents, Mary Atwood and Mario Lama, have never been 
quoted in media reports about their son, but they agree to respond in 
writing to some of my questions. ("As long as they don't show you 
any baby pictures," Adrian grumbles.) I ask them several: What was 
he like as a kid? Are you proud of what he does? Do you ever just 
wish he'd get a “normal” job? What's the source of his unique outlook 
on life? Mario and Mary, whom Adrian refers to as former "young 
radical types," avoid answering most of the questions directly, but 
they do respond with a few warm paragraphs about their son. 


"Since he was a baby, he had an outstanding intelligence and verbal 
ability," they write. "By the time he was three, he was already 
completely bilingual (English/Spanish). He easily jearned to read at 
home and always loved books. As a child, he wasn't the type that 
tinkered with gadgets, although he did begin playing with Lego's at a 
very young age. ... When he was 6 years old, he received his first 
computer, a Commodore 64, from his grandmother, and soon 
mastered its use." 


Indeed, it was this Commodore -- the first personal computer for so 
many American families in the 1980s -- that sparked Lamo's interest 
in virtual trespassing. . 
He was playing a text-based adventure game, in the ancient era 
before full-color graphics, and became “intensely frustrated” because 
he couldn't get past a certain point. "I neglected to pick up the 
pebbie-of-something, so consequently I couldn't get through the so- 
and-so," Lamo recalis with a grimace. “After days of trying to get 
through, I said, ‘Fuck this,’ and I picked up the Commodore's manual 
and read about the list command, which shows the program code. I 
rewrote that particular part to let me through, and that was that." He 
shrugs. "Really, everything since then has been larger versions of 
that, being unwilling to accept reality as It's presented to me, the idea 
that this is denied to me, and there's no way around it.” 


He pauses. “There's always a way around it.” 


After his parents moved to Sacramento, Lamo began drifting around 
the city, working at a few nonprofits, doing some security work for 
Levi Strauss. He lived in a furnished apartment for a while, although 
when he moved back out, plastic sheets still covered most of the 
furniture. "I never made a conscious decision to start bouncing 
around,” he says. "I just wasn't interested in finding an apartment in 
the Bay Area during the dot-comness." 
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He discovered he could live on about $50 a week, plus or minus the 
occasional check from his parents or gift card from a sympathetic _ 
friend, and got what little income he needed through an odd bit of 
freelance computer work. He has even been an assistant to a private 
investigator. His lifestyle, needless to say, made it difficult to apply 
for, much less hold, a regular job, and he wasn't willing to abandon 
his wayfaring ways. He had begun hacking in high school -- where he 
got thrown out of the only computer class he ever took (to this day, . 
his computer skills remain entirely self-taught). -- and decided to 
devote himself to exploring both the real and virtual worlds. “I'm just 
as likely to be wandering around an abandoned buiiding or crawling 
through a storm drain as I am to be poking around something 
oniine," Lamo says. “And I think both of them are equally valid. I 
think me getting stuck In a storm drain in New Jersey is every bit as 
important as breaking into the New York Times.” 


His parents, for their part, say they are pleased that Adrian has found 
an application for his unique talents; they don’t discuss with me any 
concerns they might have about their son landing in prison, "We have 
always encouraged Adrian to be a critical thinker,” they write, “and 
are proud of his intellect, and that he appiies his skills to what he 
likes most, computer security." 


Besides, they probably couldn't convince Lamo to change his line of 
work if they tried. “This is what I'm here to do," Lamo says, his jong, 
slender fingers still gliding across his keyboard in the Sacramento 
coffee shop, now suffused ina jate-afternoon glow that lends a bit 
more radiance to the hacker's near-translucent skin tone. "I think 
everything we do has ripples beyond what we see, even if the only 
thing that sees the ripples is the universe Itself. I just have a real 
strong feeling that this is what T'm born for, and what I'm doing isn’t 
wasted. I just feel compelled to explore.” 


A few minutes later, a guy with a crew cut and a thick build enters 
the coffee shop; Lamo stops talking, shuts his japtop, and follows the 
guy with his eyes. “There is an FBI office in that building over there," 
Lamo says, motioning out the window. “It's not in the building 
directory, but it's there, on the top floor." 


With the kind of access Adrian Lamo stumbled across in 2001, almost 
by accident, any employee at WorldCom could have turned off the 
internal computer network for Bank of America. 


He's eaten now; he feeis better. Darkness has fallen outside the 
Embarcadero Center; it's a few weeks after we met in Sacramento. 
He's been out of touch again, “regrouping personally," as he puts it, 
and preparing for the hack he's about to announce. “I need to make 
sure I have cash on hand, places to go," Lamo says, and his tone 
hardens. "I want to make sure that, if things go south, they won't be 
able to say, “"Lamo was hopelessly naive, that he was just sitting 
around in his bedroom at his parents’ house." 
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After a sleepless night and a long day, Lamo is about to head 
downstairs to a meeting of 2600: The Hacker Quarterly. He has. 
occasionally contributed to the magazine, named after the 2600-hertz 
signal that enabled hackers in the 1970s to access AT&T's fong- 
distance switching system and make free calls, and considers it his 
duty, when in San Francisco, to drop by the meeting and hobnob with 
his fellow hackers. Most of the dozen or so attendees tonight are 
males with backpacks, although one is a woman with gray hair, and 
the best T-shirt says: "I see dumb people." Before Lamo sidies up to 
the group, clustered in the plaza, he mutters, “My God, I started 
going to meetings in 1996 -- I feel old." 
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A Duty to Hack 


«BACK Actually, Hacker Quarterly 
began publishing its tips, trade 
secfets, and commentaries way back 
in 1984, about the time computer 
espionage exploded into the national 
consciousness. The previous year had 
brought the popular film War Games, 
which starred Matthew Broderick as a 
computer wiz kid who mistakenly 
cracks into the military's nuclear- 
combat simulator computer and 
saves the world by programming the 
machine to play tick-tack-tee. The 
first high-profile arrests of real 
hackers occurred around the same 
time, when the FBI busted six 
teenagers from Milwaukee known as 
the 414 Gang (named after the local 
area code), who broke into more than 
60 computers, including those at the 
Los Alamos National Laboratory and 
Sloan-Kettering Memorial Institute. 


But the hacking tradition didn't start 
with criminality -- it started with 
graduate students at the 
Massachusetts Institute of Technology 
in the early 1960s, Tapping into the 
mainframe computer in the artificial 
intelligence lab, they pushed the 
boundaries of programs and earned 
the complimentary nickname 
“hacker.” The Internet, of course, 
remained largely unexplored until the 
personal-computer boom of the 
1980s, and it only became a staple of 
American life with the advent of e- 
commerce in the 1990s. As capital 
entered the flow of the information 
highway, hackers began finding more 
and more pathways closed to them, 
and the relationship between 
companies and intruders grew 


Paolo Vescia 


Len 
Standing outside a 
Greyhound termina! with 
his Palm Top, Lamo says 
he always drifts back to 
San Francisco because the 
city is "big enough to 
wander in but small 
enough to not be 
impersonal.” 
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increasingly bitter. 

Letters 
"Malicious hackers like to illustrate Letters to the Editor 
the impact of what happens when Week of April 16, 2003 
they're ignored,” says Douglas 
Thomas, an associate professor at the University of Southern 
California and the author of Hacker Culture, which explores the 
history and psychology of the movement. “The benevolent hacker 
says, 'Your fly's open, here's how to close it.' The thing I find 
interesting [about Adrian] is the idea of a hacker as a kind of 
consumer reporter on the world. He's doing a public service, finding 
these holes, and that seems to have a noble spirit to it." 


But it's still a felony under several federal laws, most notably the 
Computer Fraud and Abuse Act, which was passed in 1984 and has 
been amended several times since. After the terrorist attacks of Sept. 
11, 2001, Attorney General John Ashcroft strengthened that law, and 
others, through the Patriot Act, which expanded the government's 
powers to pursue alleged criminais online, listen to wiretaps, and 
monitor Internet usage. Although many in government and industry 
have downplayed the threat of cyberattacks from terrorist groups like 
al Qaeda, regular hackers do plenty of damage. According to the San 
Francisco-based Computer Security Institute's seventh annual 
Computer Crime and Security Survey -- which polls more than 500 
U.S. corporations, government agencies, financial and medical 
institutions, and universities -- 90 percent of the respondents 
reported computer security breaches in 2002, and 80 percent said 
they suffered financial losses. The 223 respondents who were willing 
or able to quantify the damage done by hackers reported a grand 
total of $455 million in losses; the institute estimates that hackers did 
well more than $1 billion of damage in the United States last year. 


*t'm not a jurist, but I recognize that what I'm doing is illegal, and I 
don't think the way I'm doing it makes it any righter than how anyone 
else would do it," Lamo says. “I'm sure someone somewhere has 
gotten fired because of what I do. These things happen. I've run 
networks myself and I've been intruded upon, so no one can say I 
don’t know how it is. But as long as I'm doing it, I feel it's important 
to set a precedent so companies say, 'You know, everything didn't go 
to hell after we let him go." 


Although Lamo seeks a cordial relationship with the companies he 
hacks -- some have even offered him a job, though he turns them 
down because he doesn't want people to think he's profiting from his 
exploits -- and takes pride in showing corporations his points of 
access, he's not naive enough to think his relative benevolence will 
get him off the hook. In fact, Lame -- who says with absofute 
sincerity, “I never assume I'm not being surveilied” -- even posted an 
anonymoyis screed to an Internet discussion board in defense of the 
Patriot Act. “Many of you armchair attorneys general out there might 
not be so quick to fault the measures being taken now if you 
suddenly found yourself saddied with the responsibility of securing 
the lives of millions of your felfow citizens,” he wrote. “As someone 
who does things that are iliegal, I'd rather not have increased 
scrutiny. ... However, it's a no-win for a decision maker like Ashcroft. 
I don't know what I'd do if I were him. Neither do any of you. You 
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*don't know* what you'd do in someone else's shoes until you 


actually have to face their decisions. Moralization is easy. Making 
decisions that may save or cost lives is hard.” 


There are many in the computer security industry who, while freeiy 
admitting they find some form of nobility in Lamo's peculiar brand of 
hacking, worry that those who follow his lead may do so not because 
they admire his spirit, but because they want to grab some headlines 
themselves. 


“Benevolent hackers have been a piece of the computer underground 
for years," says Skoudis of Predictive Systems. “Adrian doesn't leave 
me ill at ease ... he's too smart. My fear is that it's not reproducible. 
Adrian does his thing, but Adrian is pretty decent about what he 
does; someone who doesn't have his skills, or his personality, could 
be like a bull in a china shop." 


FBI officials, meanwhile, won't say whether the bureau has ever 
investigated any of Lamo's intrusions. “There's no way I'd be able to 
tell you that," a spokeswoman in the FBI's Washington, D.C., office 
says. . 


At one hotel in Washington, D.C., there's a vending machine that 
dispenses 20 cents in nickels every time it's hit with a Taser, an 
electric stun-gun meant for personal defense that is one of the more 
useful things Adrian Lamo has ever owned. “You never know what 
something's going to do when you Tase it," Lamo enthuses. "It's like 
the Swiss Army Knife of electronic devices. " 


it's a mild Sunday evening in late March, and Lamo has cashed ina 
gift card at Banana Republic for a new black jacket, which he wears 
over his usual dun-colored pants and boots. He's also sporting a new 
black shoulder bag -- complete with a sleeve on the strap for his cell 
phone -- that he bought, with another gift card, at the Gap. Protests 
against Operation Iraqi Freedom have roiled these streets in 
downtown San Francisco for much of the past two weeks, but Lamo 
has been away from the city, recuperating, again, from too many 
steepless nights. Since turning 22, Lamo has noticed that his sleep 
schedule (or lack thereof) has been harder on him, and as we walk 
down the mostly empty streets, he stops to gaze in the window of a 
health food store. He's heard that some herbs and vitamins have 
anti-convulsive properties, which might help him stave off the spasms 
he suffers when he doesn't get enough rest. The convulsions are the 
result of a neurological disorder, which Lamo says stems from an 
amphetamine overdose he endured last year. As with most of the 
steady influences on Lamo's life, drug use is something he regards as 
a necessary element of his lifestyle -- which also includes mainlining 
caffeine-laced energy drinks like Red Bull, Jolt Cola, and Mountain 
Dew Code Red. 


“T'ye resisted including this in news reports because I think it would 
make me intolerable to the government if 1 was advocating both 
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intrusion and drug use, but substances that disassociate you from 
your senses have played a big part in my life,* Lamo says. “The point, 
with substances, has always been to show myself where I can go 
without them. Drugs are not an indispensable part of my life. But 
there are times when I'd rather stay up until the next bus comes. 
instead of curling up and finding my backpack gone when I wake. 
There are times I don’t want to feel the pain." 


He pauses, stops on a comer of the sidewalk in the Financial District, 
and waves his hand toward the nearest storefront. "This is my historic 
Kinko's," he says. "A great many of my compromises occurred here. I 
belleve it's still 24-hours ..." Peering at the sign on the door, he steps 
back, aghast. “Goddamn It, it's not! How could they do this to me?” 
He shakes his head, then slips back into his role as tour guide. “It 
does not have a restroom but it has a vending machine, so I can keep 
the Code Red coming. So much miscellaneous stuff has happened 

3 from this Kinko's, from that far desk over there. Most of the 
exploration for the WorldCom intrusion happened here." 


Before he penetrated the New York Times, Lamo's incursion into the 
troubled telecom giant WorldCom was perhaps his greatest coup. It 
was vintage Lamo: He was drifting around the company's site, with 
no preformed pians to hack it, when one thing led to another, Over a 
handful of all-day sprees -- "whenever I'd get bored and remember 
WorldCom," as he puts it -- Lamo got access to the company's 
internal system via open proxy servers, dedicated machines that act 
as a go-between for employees’ computers and the Internet. This, 
too, is his trademark, Whereas most hackers obsess over known 
software vulnerabilities, endlessly scanning a company’s security 
applications in the hopes of finding a random glitch, Lamo sneaks 
through these more nebuious, less intentionally geeky, holes. When 
brought online, proxy servers are often misconfigured, both accepting 
and forwarding connections from the outside as weil as the inside, 
and Lamo can change his browser's preferences to match those of the 
proxy server, 


Open proxy servers don't require a username or password, and once 
inside a company’s system, Lamo hunts down passwords that enable 
him to view other pages on the company's own intranet. And this is 
one of Lamo's fundamental! gripes: When you put a network, any 
network, online, you accept the responsibility for securing it, he says. 
And spending millions of dollars on front-door security software 
doesn't mean anything if the back door is wide open. 


Lamo broke the news of his intrusion into WorldCom through the Web 
site SecurityFocus.com, and officials at the telecom company said 
they appreciated Lamo's help in drawing attention to the problems 
with their system. (It took a weekend of Lamo's assistance to close 
the holes.) "All these companies T've compromised, they've never had 
a clue until I told them," says Lamo, who has a computer screen-shot 
of WorldCom's stock falling the day he disclosed his hack. “To an 
extent, it's because of my approach. Classic intrusion software looks 
for an attack -- nothing I do looks like an attack. It's the same stuff a 
user would do, and you can't determine what the intent of a user is." 
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His nomadic lifestyle is another reason he's never been caught; Lamo 
always works alone, and he travels without companionship. Given his 
admitted contempt for returning phone calls promptly -- "Some 
people are rudely late," Lamo says, "I try to be absurdly late" -- it's 
hard for him to make persona! relationships last. Although he's got a 
iot of friends across the country, he usually leaves before those 
friendships bloom into something more. 


"In a way, I'm sort of fated to be a bright, fast-moving object in 
people's ives," Lamo tells me one night. "I tend to enter abruptly, 
make massive change in their life, and leave just as abruptly. I keep 
in touch with people, but I try not to let my words be taken with 
inappropriate weight by people around me. I've seen the effects of 
people's long-term association with me, and I just feel strange about 
changing people's lives so drastically. You know, people who were 
nice suburban boys two years ago, and now their mom wonders what 
happened to them." 


A few evenings later, I meet a friend of Adrian in downtown San 
Francisco. His name is Nevin Williams, and he's a 32-year-old 

network administrator in a red sweat shirt that says “Canada.” They 
met through a mutual friend in the computer world, and it's a credit 
to both Williams and Lamo that they still talk: Williams, as it happens, 
was lead engineer at Excite@Home when Lamo hacked the system 
and added his name as a security consultant to the company 
directory. Williams didn't hold it against him, and Lamo has since 
crashed many a night at Williams’ house in the suburbs. Although he 
cautions Lamo about the risks, Williams doesn’t try to change his 
friend's path. "With Adrian, it's a spiritual thing. This is his religion. 
It's something he believes in, and he's not two-faced, This is genuine. 
Many people don't understand it -- I don't claim to understand it, 
either.” 


Williams shrugs. "I just request he doesn't use my networks in the 


- process of doing whatever he's doing," he says. “And I really hope 


T'm not with him when the FBI or the CIA swoops in.” 


For the past several years, there's been a bench warrant out for 
Adrian Lamo in Sacramento County. He got it several years ago for 
riding public transportation without a ticket. "There's irony in the fact 
that the whole time I was doing all these crimes, they had license to 
take me in,” Lamo says. “I hope the universe enjoys absurdity as 
much as I do. I suspect it does.” 


On a windy afternoon in Yerba Buena Gardens, Lamo and I settle in a 
rare patch of sun on a round stone bench. He's talking into his cell 
phone to Williams. “I'm sure it's not messy by my standards," Lamo 
assures him. "I'm used to abandoned buildings." After he hangs up 
the phone, Lamo sighs, and says, "T hope I don't die of asbestos 
poisoning a few years down the road, but if I do, it will have been 
worth it.” 
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His recent birthday, I think, has caused Lamo to question his 
mortality. He seems on edge, and when I ask him about his 
impending disclosure, he says he's not dissuaded by the target 
company’s reputation for hunting down hackers -- “Intimidation is not 
a substitute for security," he insists -- but admits to weighing the 
ramifications. At one point, he stares into the sun, his brows locked, 
and considers a question about how he would fare in jail. 


"T don't know; I could be happy indefinitely sitting here in the sun, 
and this could be a prison yard if you put walis around it," he says at 
last. "But prison would curtail what I do, and it would be unpleasant." 


So why go through with it? He gives his standard line: "This is what I 
do, this is the role I was born to play." And he refers, as he often 
does, to a quote from Frank Herbert's 1965 science-fiction epic Dune, 
the story of a young man whe becomes & messiah. At home that 
night, I look up the passage: "The person who experiences greatness 
must have a feeling for the myth he isin. ... And he must have a 
strong sense of the sardonic. This |s what uncouples him from belief 
in his own pretensions. The sardonic is all that permits him to move 
within himself, Without this quality, even occasional greatness will 
destroy a man." 


Only then do I understand: In his mind, Lamo's life is a new kind of 
story for the Information Age, the quasi-mythic saga of a traveler, 
perhaps not so different from Dune's, whose adventures are neither 
wholly corporal nor wholly virtual. If Lamo spends too much time 
considering his actions, he steps too boldly out of the character he's 
created. And more than anything, I think, Lamo wants to know how 
his story will end. 


In that respect, at least, he's not so different from the rest of us. 


i 
vB 
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mo: Las Vegas atta; [ 


From: New York 
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Title: ADRIAN LAMO; 
New York Times~-Victim; 
Computer Intrusion; 
OO:NY 


Synopsis: Request assistance from Las Vegas in the arrest of 
ADRIAN LAMO bé -1 
6 - 


Reference: TELCAL WITH. —=«4di 07/28/2003 b7c -1 
Details: Four (4) Agents from the New York Office (NYO), writer, 


SA SA and SA will be 
traveling to Las Vegas, Nevada on July 31, 2003 to attend DEB’ CON 
from August 1-3, 2003. 


The NYO is obtaining an arrest warrant fo aperayfano>y 
Information obtained by the NYO has revealed that LAMO wi} 
attending DEF CON. The NYO requests assistance from the ‘Las 
Vegas Division in the arrest and apprehension of LAMO while he is 
Las Vegas. 


LAMO is called the "homeless~hacker". He travels 
frequently by greyhound from the West Coast to the East Coast. 
LAMO does not have a permanent residence. He normally stays with 
friends or lives on the street to survive. Infrequently, he E 
performs computer security consulting work to make money to 
support himself. LAMO has recently threatened the National 
Infrastructure of the.Umited States. LAMO stated that when he 
hagks this thaj.ox™: Tnfrastructure he will flee. Due to the vagrant 
nature of his lifestyle’ and the threat against the 
inf ea eeeBdrs,” itis Hecessary to arrest LAMO when he attends 
DEFCOIERL WOT + 


Abroynen 
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To: Las Vegas From: New York, b3 -2 
Re: C.. 07/29/2003 DIE -3 


Three (3) NYO Agents will arrive in Las Vegas on July 
31, 2003 at noon. Writer requests assistance from the Las Vegas 


Division in the planning and execution of the arrest of LAMO. b6 -1 
Writer requests a meeting on July 31, 2003 with the individual b7c -1 
who will be representing the Las Vegas Division in the arrest. ~ 

fhe arrest plan will be determined at this time. After LAMO's bE -7 


arrest, the processing and interview will be conducted at the Las 
Vegas office by writer and SAL] 
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To: Las Vegas From: New -York, b3 -2 
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LEAD (s): 
Set Lead 1: (Info) 
LAS VEGAS 
AT LAS VEGAS 


Read and clear. 


had 
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FEDERAL BUREAU OF INVESTIGATION 


Precedence: ROUTINE Date: 07/21/2003 


To: 


Sacramento Attn: Computer Intrusions Squad 
San Francisco 
Los Angeles 
Baltimore 

Las Vegas 
Washington Field 
Philadelphia 
Albuquerque 
Memphis 

Denver 

St. Louis 

New Orleans 
Phoenix 

Cyber 


From: New York 


Squad DT-5 


b3 -2 


p7C -1 
Be 
Case ID # Cd Phos DIE -3 


Title: ADRIAN LAMO; 


New York Times-Victim; 
Computer Intrusion; 
Oo: NY 


Synopsis: Conduct logical interviews after arrest of ADRIAN LAMO 


Enclosure(s): Packet containing | ACS checks, 
criminal history, DMV history and Internet checks 


on each interviewee 


Copy of article from sfweeleby-cor i ecent 
interview of the subjed¢t, ADRI. / LAMO 


List of suggested interview questions for each 
interviewee (Suggested questions worksheet) 


Deyg oe Bhotograph of ADRIAN LAMO 
a S00, 


ALG IB 
UL EY oe 


NeF ODED 


b7E -2 


/ '@ @ 3 
Tor : New York DIE -3 
Re: 07/21/2003 ° 


If applicable, copies of L__ logs of bIE -2 
individuals who access unauthorized Lexis/Nexus 
userids 

pevat ag dons us iS a twenty two (22) year old male, who 

commits utisrized computer intrusions into major corporations. 

LAMO is labeled in the media as the "homeless hacker". He 


considers himself a "white hat hacker". Investigation by the New 
York Office has revealed that LAMO is a "black hat hacker", an 
individual who breaks into a computer system with the purpose of 
inflicting damage or stealing data. Each time LAMO hacks a major 
corporation, he first alerts friends in the media. The friends 
in the media then contact the victim company and ask for comment 
for their story. This is first notification the victim company 
receives that their network security has been breached. 


In September 2001, LAMO hacked rapbot and, rewrote the 
text of a YAHOO! News article. LAMO gained access through the 
portal's web-based production tools and modified a news story 
about DMITRY SKLYAROV, a Russian computer programmer facing pé —5 
federal criminal charges. LAMO used a free internet connection 
at KINKOS to commit the hack. YAHOO! was informed of the breach D7C —5 
after being contacted b who 
was contacted by LAMO. was convicted in 1990's by the 
FBI for committing unauthorized computer intrusions. 


eS Se LAMO vegntacted the reporter,[ _| bo -2, -5 
o inform him that he had gained b7C -2, -5 
unauthorized access into a MECR ustomer service database. 
LAMO had gained access to MICRQSOFT's database is September 2001 
but choose not to disclose his access until October 2001. LAMO 
utilized a vulnerability in MICROSOFT's network that allowed an 
unpublished Internet Protocol (IP) address to be entered into a 
web browser. The IP address provided access to records of the 
individuals who had purchased products and services from 
MICROSOFT. The first notification of this unauthorized intrusion 
was conducted by[___|]who contacted MICROSOFT asking them for a 
comment to his story he was writing regarding the hack. 
MICROSOFT confirmed the hack and 
described the incident as "an error that led to a 
breach of privacy, against our privacy policy". 


In December 2001, LAMQ contacted the reporter,[___—id b6 -5 


0 Anform him that he had ‘gained BIC —5 
unauthorized access into MC RLDCOM's internal network. LAMO 
gained access to WORLDCOM'’s internal network in October 2001 but ~ . 


choose not to disclose his access until December 2001. LAMO 
provided internal screen captures to WORLDCOM to prove he was the 
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hacker, The screen captures from WORLDCOM's internal network 
state, "Not to be reproduced in any manner or disclosed to 
unauthorized individuais". LAMO gained access to WORLDCOM's 
internal network using a free internet connection at KINKOS. 

LAMO exploited a vulnerability in a WORLDCOM proxy server to gain 
unauthorized access to their network. After committing the hack 
and reporting it to[______] LAMO commented "The downside is, I'm 
running out of major US Corporations". Also, one of LAMO's 
prized possessions is a screen capture of WORLDCOM's stock price 
falling after he announced he had hacked the company. 


In February 2002, LAMO contacted the reporter, | 
to inform him that he had gained 

unauthorized access into SBC CO ICATIONS. LAMO gained access 
to SBC COMMUNICATIONS netwOork-¥a-December 2001 but choose not to 
disclose his access until February 2002. utilized an 
exploit to gain access to SBC's internal network. LAMO used a 
free internet connection at KINKO's to perform the hack. LAMO 
gained access to usernames, passwords, telephone numbers, 
addresses and other sensitive customer information. 


In February 2002, LAMO discovered several misconfigured 
proxy servers acting as doorways between the public Internet and 
the NEW YORK TIMES private intranet. LAMO contacted[7 Jof 

o inform him that he had gained unauthorized 
access into The NEW Y@RK TIMES intranet. LAMO utilized the proxy 
servers to ga NEWYORK TIMES network, Once on 
the network, LAMO cfacked a password for a userid with supervisor 
rights. Utilizing this userid he was able to broaden his access 
as well as perform certain functions within the network. LAMO 
created four (4) Lexis/Nexus accounts off of the NEW YORK TIMES 
intranet and utilized these accounts for himself and/or friends 
to run over 3,000 searches of individuals, address and/or court 
documents. 


LAMO has committed other coybuter intrusions into 
several other corporations such as A and EXCITE@HOM. Bach 
time LAMO commits a computer intrasd o i 
organization, he reports the vunerability and intrusion to the 
media causing a distrust of the company's clients. The above 
mentioned corporations have lost significant money and trust of 
their clients due to LAMO's actions. 


In the enclosed San Francisco Weekly article, dated 
April 16, 2003, LAMO states "he is preparing to announce, ina 
few days, weeks or months -- whenever he decides the time is 
right -- his biggest hack yet. On the record,.he defines his 
target as a "critical-infrastructure-related company"; off the 
record, he exhibits ample evidence of his repeated incursions 
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into the corporations internal system." NYO believes that LAMO 
is a threat to the infrastructure of the United States. 


The NYO along with the Southern District of New York 
(SDNY) are currently completing a complaint charging LAMO with 
his unauthorized access into WORLDCOM, NEW YORK TIMES, 
LEXIS/NEXUS, SBC COMMUNICATIONS and MICROSOFT. The NYO and the 
SDNY will have the complaint completed the week of July 21, 2003. 
The NYO will charge his other hacks upon indictment. 


LAMO is reports to be homeless and usually stays witb6 -3, -35 
friends or in hostels for lodging. LAMO makes money in the b7C -3, -5 


computer_security field, when ne ary. His ce hone bill 
residence at. 
LAMO Keeps im contéct wi we, nOw! 


Upon his arrest, the NYO has identified five (5) groups 
of individual who need to be interviewed regarding LAMO. In 
total approximately 225 individuals will be interviewed. The 
groups are as follows: 


1. Individuals he contacts via telephone 

2. Individuals he has close relationships with (Will 
be providing Grand Jury subpoenas) 

3. Individuals that were run in Lexis/Nexus 

4. Individuals whose IP addresses were used to run 
unauthorized Lexis/Nexus searches (Will be 
providing Grand Jury subpoenas) 

5. Individuals he is friends with but are reporters. 

(We are currently obtaining Department of Justice 

approval to conduct these interviews) 


This communication is to address the individuals with 
whom LAMO has close relationships and individuals whose IP 
addresses were used to run unauthorized Lexis/Nexus searches. 
Investigation by the NYO has revealed that several of the 
interviewees IP addresses were used to access the unauthorized 
Lexis/Nexus accounts. These individuals will be noted below. 
When interviewing these individuals determine what other 
individuals have/had access to their internet conn 4 uring DIE -2 
the time period of 1/2002 to 3/2002. Copies of the logs of 
these individuals are provided in enclosures. LAMO may Rave also 
provided these individuals with access to the unauthorized 
Lexis/Nexus userids and/or talked about all his computer hacking 
activities. Please note, due to the time limit placed on 
retaining logs by Internet Service Providers, not all subscribers 
of IP addresses that accessed the unauthorized Lexis/Nexus 
userids could be determined. The individuals to be interviewed 
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To: Sacramento From: New York 
ne: [07/23/2003 PTE 


names and addresses were run in the searches of Lexis/Nexus that 
were accessed by the unauthorized accounts. 


The Wyo has conductea[____ | criminan 9 7P ~? 


history ‘checks, DMV checks, ACS checks and Internet checks on all 
the individuals writer is requesting to be interviewed. Writer 
has put details pertaining to each interviewee in the leads 
section of this communication. The NYO and the SDNY have obtained 
Federal Grand Jury subpoenas for testimony for each interviewee. 
Interviewing agent(s) are to use their discretion in serving the 
Federal Grand Jury subpoena on each interviewee. 


Writer requests to be contacted by Agents who are 
assigned to conduct interviews either by telephone or email. The 
purpose of this request is to allow writer to contact the 
appropriate Agent to inform them of LAMO's arrest, so that 
interviews can be conducted. Please conduct interviews within 
two (2) months of being contacted by writer. 


Interviews pertaining to individuals he contacts via 
telephone and individuals that were run in Lexis/Nexus were 
already received by the appropriate offices. Interviews 
pertaining to individuals he is friends with but are reporters 
will be sent under a separate lead. The NYO office is currently 
obtaining Department of Justice approvals for these individuals. 
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To: Sacramento 2 New York 
re: _J07/21/2003 b3 -2 


LEAD (s) : 
Set Lead 1: (Action) 
SACRAMENTO 
AT VALLEJO, CALIFORNIA 
Conduct logical interview oe 
CA, after being informed of O's arres iy 
writer. TP address was utilized to conduct Lexis/Nexus 


searches by unauthorized Lexis/Nexus userids created by LAMO. b6 -3 
The address stated above is listed on theL logs for the IP b7c -3 


address for specified dates/times_utilized in Lexis/Nexus. DIE -2 
Co“ Jaiso has another address NY. 
The NYO will be conducting interviews at that location. 


Before interview is conducted, contact writer with name of 
Agent who will be assigned to conduct logical interview of 


Set Lead 2: (Action) 
SACRAMENTO 
AT DAVIS, CALIFORNIA 


t logical interview of 
telephoné 
addr ilizea to conduc ext by 


unauthorized Lexis/Nexus the [|Log by LAMO, ‘The address be -5 


stated above is listed on the logs’ for the IP address for b7C -5 
specified dates/times utilized In Dexis/Nexus. DIE -2 


Before interview ig conducted, contact writer with name_of 
Agent who will be assigned to conduct logical interview of 


Set Lead 3: (Action) 
SACRAMENTO 
AT FRESNO, CALIFORNIA 


_ Conduct logical interview of 
after beingfinformed of LAMO's b7c -5 
ar yy writer. address was utilized to conduct 


Lexis/Nexus searches by unauthorized Lexis/Nexus userids created 
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by LAMO. The address stated below is listed on_the 
for the IP address for specified dates/times. 


The San Francisco 
conducting interviews ‘at that location. 


Before interview is conducted, contact writer with name_of 
Agent who will be assigned to conduct logical interview of 


Set Lead 4: (Action) 
SACRAMENTO 


AT SACRAMENTO 


Conduct logical interview of 


bé -5 


cess into a major corporation. 


gained unauthorized ac 
i O's hacking activities. 


very familj has a second b7C -5 
address at The 
Baltimore Office will be coriducting interviews at that location. 


Before interview is conducted, contact writer with name_of 
Agent who will be assigned to conduct logical interview of 


Set Lead 5: (Action) 
SACRAMENTO 
AT CHICO, CALIFORNIA 
after being info O's arrest by 
-WEEtEeL: 


TP address was utilized greatly to conduct 
s userids created 


Lexis/Nexus searches by unauthorized Lexis /Nexu: 
by LAMO. A second address 

was receive rom b6 -35 
performed. The address stated on the logs for the IP b7C -5 
address for specified dates/times for the unauthorized use is bIE -2 
the above mentioned address with billing sent to 

The Los Angeles and 

Sacramento Offices will be conducting interviews at those 
locations, respectively. 


Before interview is conducted, contact writer with name of 
pases who will: be assigned to conduct logical interview .of 


7 
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To: ramento From: New York b3 -2 
Re: 07/21/2003. DIE -3 


Set Lead 6: (Action) 


SACRAMENTO 


AT CARMICHARL, CALIFORNIA 


in nm M i b6 -3 
PT ,—___] DIC -3 
[...] ACS was positive for.___Jas a 
reference. Investigation by the NYO has revealed that 
utilized an unauthorized Lexis/Nexus userid provided to him by 
LAMO. 
If possible, conduct secefid interview of another b6 <a 
resident at locations, . bic -5 
Before interview is conducted, contact writer with name of 
paent who will be assigned to conduct logical interview of b6 -3 
b7c -3 
Set Lead 7: (Action) 
SAN _ FRANCISCO 
AT SAN BRUNO, CALIFORNIA 
AMO! s 
wi 7 Possible 
rovided him with an unauthorized hexis/Nexus userid. 
LAMO hacked ~ b6 -5 


excite@home. Excite@home is bankrupt and therefore was unable to bye -5 
provide any evidence of the unauthorized intrusion by LAMO. LAMO ~ 
has freely admitted to hacking excite@home. 

ized intrusion of excite@home by LAMO 


Also, in enclosed article reatens 
a major infrastructure of the United States. L___]may have 
information pertaining to which major infrastructure LAMO has 
infiltrated. Obtain as much information pertaining to this 
infiltration as possible. 
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To: Sacramento From: New York b3 -2 
Re: LC] 07/21/2003 b7E -3 


Before interview is conducted, contact writer with name of b6 -3 
Agent who will be assigned to conduct logical interview of b7IC -3 
Set Lead 8: (Action) 

SAN FRANCISCO 


AT MOUNTAIN VIEW, CALIFORNIA 


Conduct logical interview of 


@ing informed of LAMO's arrest by writer. IP address was b6 
utilized to conduct Lexis/Nexus searches by unauthorized we 
Lexis/Nexus userids created by LAMO. The address stated above igs b7C -5 


listed on the logs for the IP address_for specified b7E -2 
dates/tines J a0 has another address a 

The Sacramento Office will be 
conducting interviews at that location. 


-5 


Before interview is conducted, contact writer with name_of 
Agent who will be assigned to conduct logical interview of 
Set Lead 9: (Action) 

SAN FRANCISCO 


AT HOLLISTER, CALIFORNIA 


being informed of LAMO's arrest By 
IP address was utilized greatly to conduct b6 


-5 


Lexis/Nexus searches by unauthorized Lexis/Nexus userids created c 
by LAMO. The address stated above is listed on the logs bIC ~y 
for the IP address for specified dates/times. Determine if LAMO DIE -2 


LAMO. C7 and iso to be 
interviewed regarding use of IP address) determine 
relationship. 

Before interview is conducted, contact writer with name of 
pasate who will be assigned to conduct logical interview of 
Set Lead 10: (Action) 


SAN FRANCISCO 
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To: Sacramento From: New York DIE -3 
nes 27/28/2008 


AT SAN FRANCISCO, CALIFORNIA 


ical interview of 


afterfbeing informed of 
LAM ay have been provided a b6 -5 


Lexis/Nexus userid by LAMO. bic -5 


Before interview is conducted, contact writer with name of 
ee i will be assigned to conduct logical interview of 


Set Lead 11: (Action) 
SAN FRANCISCO 


AT PLEASANT HILL, CALIFORNIA 


1_interview of 


eing informed _of 
is a_known hacker and is 

has hacked LAMO is 
has a second address of b6é -5 
The Los Angeles Office will DIC 5 


be conducting interviews at that location. 


Also at location_is Conduct 
logical interview of 


Before interview is conducted, contact writer with name of 
Agent who will be assigned to conduct logical interview of 


Set Lead 12: (Action) 
SAN FRANCISCO 


AT HOLISTER, CALIFORNIA 


Conduct logical interview of 


rv being informed of LAMO's arres yy writer. - 
IP address was utilized greatly to conduct Lexis/Nexus bIE -2 


searches by unauthorized Lexis/Nexus user} ted by LAMO. 
The address stated above is listed on_the logs for the IP 
address for specified dates/times. me re 


determine relationship. 


10 
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: New York - 


Before interview is conducted, contact writer with name of b6 -5 


pee will be assigned to conduct logical interview of pic _5 
2-5 
Set Lead 13: (Action) 
SAN FRANCISCO 
AT SAN FRANCISCO, CALTFORNIA 
Conduct logical interview of | 
ormed of 
LAMO! He is - og 
a is familiar with the be -5 
hacking activities of LAMO. b7C -5 


Before interview is conducted, contact writer with name of 
Agent who will be assigned to conduct logical interview of 


Set Lead 14: (Action) 


SAN FRANCISCO 


AT DALY CITY, CALIFORNIA . 
Conduct logical interview ————— 
after being’ informed of LAMO's 


yy writer. IP address was utilized greatly to 
conduct Lexis/Nexus searches by unauthorized Lexis/Nexus userids b6 -5 


address | pI 5 
s received_from Lexis/Nexus checks ~ 
performed. The address stated on the Lem toes for the IP co” -2 


imes for é unauthorized use is 

with billing sent to the above’ 
mentioned address. The Los Angeles and San Francisco Offices 
will be conducting interviews at those locations, respectively. 


Before interview is conducted, contact writer with name of 
Aaent who will be assigned to conduct logical interview of . 
Set Lead 15: (Action) 

LOS ANGELES 


AT SANTA ANA, CALTFORNIA 


Il 
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To: Sacramento FrOM® New York 
re: [J 07/21/2003 


Conduct logical interview of 
telephone 


IP address was utilized to conduct Lexis/Nexu 
searches by unauthorized Lexis/Nexus user ds created by LAMO. b7 
The address stated above is listed on She “Ales for the IP FC 
address for specified dates/times. 


Before interview is conducted, contact writer with name of 
Aden who will be assigned to conduct logical interview of i 
Set Lead 16: (Action) i 

LOS ANGELES 

AT NEWPORT BEACH, CALIFORNIA 
Conduct sogicel aabeeviet of 
after being informed of "LAMO's arrest 
(of Lamo and is 
activities. LAMO possibl 


telephone 


the Lexis/Nexus userid 
One of screen names is 
Question regarding LAMO's recent threat 
to a major United States infrastructure. 


Before interview is conducted, contact writer with name of 
fasne sp will be assigned to conduct logical interview of 
Set Lead 17: (Action) 

LOS ANGELES 


AT YUCAIPA, CALIFORNIA 
Conduct logical interview of eT 
after being 5 aan b6 5 


ress of 
The San Francisco 
Office will be conducting interviews at that location. 


Before interview is conducted, contact writer with name of 
—_ who will be assigned to conduct logical interview of 


12 
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To: : New York ‘ 
b3 -2 
F mere bIE -3 


Set Lead 18: (Action) 
LOS ANGELES 


AT THOUSAND OAKS, CALTFORNIA 


Conduct logical interview of 


informed of LAMO's arrest by writer. 


intrusion by LAMO 
is currently attempting to make a 
Before interview is conducted, contact writer with name of 
(eae who will be assigned to conduct logical interview of 
Set Lead 19: (Action) 
LOS ANGELES 


AT MORENO VALLEY, CALTFORNTA 


Conduct logical interview of 


Writer ress was utilized 2 
greatly to conduct Lexis/Nexus searches by unauthorized be -5 
Lexis/Nexus userids created by LAMO. The address stated above is HG) 25 
ee checks performed. The address stated on the bIJE -2 


logs for the IP address for specified dates/times for the 
unauthori i with billing 
sent to The 


Sacramento and San Francisco Offices will be conducting 
interviews at those locations, respectively. 


Before interview is conducted, contact writer with name of 
foo will be assigned to conduct logical interview of 
Set Lead 20: (Action) 

BALTIMORE 


AT._NORTH POTOMAC, MARYLAND 


13 
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To: Sacramento From: New York 
ge: Pe] 07/21/2008 


Conduct logical interview of 


address at 


The Sacramento Office will be conducting interviews a 
Location. 


Before interview is conducted, contact writer with name_of 
Agent who will be assigned to conduct logical interview of 


Set Lead 21: (Action) 
LAS VEGAS 


AT LAS VEGAS, NEVADA 


Conduct logical interview _of 


aed pos itive Lor 


Co eee ertaining to LAMO and other known hackers, b6 —-5 
a OF 


Before interview is conducted, contact writer with name of 
eed who will be assigned to conduct logical interview of 


Set Lead 22: (Action) 
LAS VEGAS 
AT SPARKS, NEVADA 


Conduct logical interview of a 
after being informed Of GAMO a aLrve D bo -5 
writer.L__JIP addtess was utilized greatly to conduce bI7C -5 
Lexis/Nexus searches by unauthorized Lexis/Nexus us: ated b7E -2 
by LAMO. The address stated above is listed on en dese 

for the IP address for specified dates/times. 


Before interview is conducted, contact writer with name_of 
Agent who will be assigned to conduct logical interview of 


Set Lead 23: (Action) 


14 
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New York b3 -2 e 


To: 
Re: fo Loan yaoos DIE -3 


WASHINGTON FIELD 


AT CENTREVILLE, VIRGINIA 


Conduct logical interview of 
afgver being #nformed 
's arrest by writer. 


and LAMO are [Fi bé -5 
LAMO possibl rovided with an unauthorized bic -5 


Lexis/Nexus userid. is familiar with the hackin 
activities of LAMO. LAMO ens 


Before interview is conducted, contact writer with name of 
care who will be assigned to conduct logical interview of 


Set Lead 24: (Action) 
WASHINGTON FIELD 


AT ALEXANDRIA, VIRGINIA 


ond: 


writer, & 


tT LAMO's ayxést b ; 
Tm ibd Dé -5 
when in the has Gl omenis: 
and graduated from Dae? 


Before interview is conducted, contact writer with name_of 
Agent who will be assigned to conduct logical interview of 


Set Lead 25: (Action) 
PHILADELPHIA 


AT PHILADELPHIA, PENNSYLVANTA. 


Conduct logical interview of 


[J The Memphis office will be conducting interviews at that 
location. 


Before interview is conducted, contact writer with name of 
are who will be assigned to conduct logical interview of 
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To: Sacramento From: New York b3 -2 


Set Lead 26: (Action) 


ALBUQUERQUE 
AT CEDAR CREST, NEW MEXICO 


i_interview of 


bé -S 
eing informe: by writer. a hacker and b7c -5 
so_is has 
Before interview is conducted, contact writer with name of 
a who will be assigned to conduct logical interview of 
Set Lead 27: (Action) 
MEMPHIS 
AT MEMPHIS, TENNESSEE 
Felepoone] =i 
crmed of ULAMO's arrest by writer- 
as a second address of bo> 8 
The Philadelphia Office wili be b7C -5 
conducting interviews at that location. 
Before interview is conducted, contact writer with name of 
= who will be assigned to conduct logical interview of 
Set Lead 28: (Action) 
DENVER 
AT COLORADO SPRING, COLORADO 
iew of 
informed of arres y writer. LAMO possi 
with an unauthorized Lexis/Nexus userid. owns bé -5 
bic -5 


Before interview is conducted, contact writer with name_of 
Agent who will be assigned to conduct logical interview of 


Set Lead 29: (Action) 
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To: Sacramento From: New York 
ne: [07/21/2003 


ST. LOUIS 


AT SAINT LOUIS, MISSOURE 


that location. 


be conducting interviews 
Before interview is conducted, contact writer with name of 
pacnt who will be assigned to conduct logical interview of 
Set Lead 30: (Action) 
NEW ORLEANS 


AT MONROE, LOUITSANNA 


interview of 


after being bé -5 
“ine S arrest by writer. lis a hacker and bic -5 
states on his enclosed resume that he works for 
onl ERS 
Before interview is conducted, contact writer with name of 
ae who will be assigned to conduct logical interview of 
Set Lead 31: (Action) 
PHOENTX 
AT TUCSON, ARIZONA 
b6 -5 
b7C -5 


used to live at 
His name and address were run in 


Before interview is conducted, contact writer with name of 
Agent who will be assigned to conduct logical interview of 
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New York 


Re: 07/21/2003 BIE -3 


Set Lead 32: (Info) 


ho CYBER 
AT WASHINGTON, DC 
Read and clear. 


Notes: DO NOT CONDUCT INTERVIEWS UNTIL CONTACTED BY WRITER 
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Individual background questions 


bIE -1 


Lamo 


bo -3 
b7C -3 
bITE -1 
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Lexis-Nexus (This section specifically for the people who I noted either had 
?s or the logs identified them as the individuals who used the ids) (You 
may have to interview others in the household regarding the IP addresses used may not 


directiy be subscriber) 


IO 
iS 


b7E -1 
b6 -5 

bIC -5 
DIE -1 
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A Duty to Hack 


Adrian Lamo, the 22-year-old “homeless hacker" 
famous for raiding New York Times computers, 
pursues his vision of public service by cracking 
another major corporate network. It's a crime, of 
course. It's also what he was born to do. 


BY MATT PALMQUIST 
matt.palmauist@sfweeldy.com 
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CAREERS: 


"Tell me the truth," says Adrian 
Lamo, ducking inte a public restroom 
in the Embarcadero Center on a chiily 
Mareh evening. " look like death, 
don't 1?" 


Well, he doesn’t look good. Lamo, 
who turned 22 a few days ago, didn't 
get any sleep last night; he says he 
was “in transit,” a fact to which his 
wrinkled cargo pants and rumpled 
brown jacket can plainly attest. His 
shoulders, as slight and bony as the 
rest of his frame, sag when he peers 
at his reflection in the scuffed mirror. 
"Yep," Lamo sighs, dropping his 
frayed backpack on the sink and 
turning on the faucet. "I look like 
death.” Dark circles bloom below his 
warm hazel eyes, his lids droop, and 
whenever he isn't blinking, which isn't 
often, his pupils swim beneath a 
glassy sheen. Biack and green spots 
mottle his yellow teeth; dirt crusts 
the edges of his ears. As he splashes 
water through his cropped brown 
hair, Lamo watches some of the color 
seep back into his face, whose angelic 
features appear pallid and ghostly at 
the best of times. "I'm feeling faint,” 
he says, his dry, nasal voice 
stumbling over a mild stammer, his 
face rippling from the occasional tic. 
Ever since an amphetamine overdose 
last year, Lamo says, he's apt to start 
convuilsing if he goes too long without 


Paolo Vescla 


Some days I have tim: 
to do things," says Lamo. 
"Other days are just a 
series of efforts to find 
out where I'm going to 
sleep that night." 
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food or sleep. “I think 1 should stop 
by Carl's Jr. and get something to Dog Bites 


On his way out of the bathroom, 
Lamo nods his head at a nearby door, 
unmarked and anonymous. “Most of rere 
the telephone switches for the 
Embarcadero are in there," he says, a 
glint returning to his eye, the merest 


the incoming call. "My attorney," he sighs, before a 


one of the most celebrated and controversial hacke 
"Lamo here." 


If you type the address 


eat." Culture Klatsch 

When the Burning Man folks 
met the Air Force guys, the 
desert camping tips flew 


Letters to the Editor 
Week of April 16, 2003 


smile spreading across his cracked, thin lips. Then his cell phone 
peais, and it takes Lamo a few heartbeats to identify the number of 


phone in the kind of crisp, authoritative monotone you'd expect from 


Uw we Jeu ie Me 


nswering his 


rs in the world: 


Internet browser, you'll see the following message, 


Lamo," 


number is 505-HACK. ("Everyone assumes there w 


the upper right-hand corner, the only thing to jook 


see me ail the time, they just can't remember how 


(pronounced Lah-mo), it's considerably harder to g 


collection agency.” 


into the New York Times and pilfering, among othe 
Security numbers, editing notes, and reimburseme: 


Jimmy Carter. Media reports about the incident wet 


http://www.sfweekly.com/ igsues/2003-04-16/feature.html/1 /index.btml 


wunw.sfweekly.com/Examples/FileLibrary /I Files/y0.txt into your 


ona white background: "Confidential to Matt Paimquist: Sorry I never 
really got back to you when you emailed. Give me a ring! -- Adrian 


Reaching Adrian Lamo is not particularly difficult. His cell phone 


wrongdoing involved," he says of obtaining the number, “but like with 
so many things, all you have to do is ask.") His e-mail address is 
adrian@adrian.org, which you can locate with ease on Lamo's very 
own Web site (http: //adrian.adrian.org). He admits he’s not much at 
Web design, and his home page, whose header says “Faith manages,” 
is certainly stark: Other than a biurred, pixelated image of Lamo in 


pointed and trenchant, from the Bob Dylan song "Idiot Wind": “People 
are filled with big ideas, images, and distorted facts/ Even you, 


yesterday, you had to ask me where it was at/ I couldn't believe, after 
all these years, you didn't know me any better than that." 


In other words, though it's not hard to get in touch with Lamo 
and perhaps hardest still to actually meet him. "Who is this?” he asks 
when I call him one day in early 2003. "Oh, I thought you were a 


We'd been exchanging e-mails and phone messages for almost a 
year, ever since Lamo grabbed headlines around the world by hacking 


several of the Times’ more high-profile op-ed contributors, among 
them William F, Buckley Jr., Robert Redford, and former President 


in plain black text 


as some 


atis a verse, 


to act/ Their minds 


jet to know him -- 


r things, Social 
nt figures for 


re, on the whole, 
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brief and bemused ("All the News That's Fit to Hack," chortled the 
New York Post) and absent all but the most basic details about the 
young man who could, if he so wished, ring up Warren Beatty or Rush 
Limbaugh at home. The basic details: In the past few years this so- 
called "homeless hacker," a drifter who rides Greyhound cross- 
country and crashes in abandoned buildings or on friends’ couches, 
has trolled, undetected, through the innards of corporate giants like 
America Online, Yahoo! (where he edited himself into news stories), 
the now-defunct Excite@Home, the now-bankrupt WorldCom, and, 
most recently, the Times. And he did all this using Internet Explorer, 
usually from a computer at a Kinko's. His methods are refreshingly 
low-tech -- he often exploits open proxy servers, which, after 
configuring a Web browser properly, can act as doorways between 
the public Internet and a corporation's private computer network -- 
and he always telis companies how to close the holes he's found. 
Lamo’s willingness to help the companies he hacks is part of his 
charm, and also part of the reason he has so far avoided prosecution. 
(Drifting around the country helps, too.) 


“In the computer underground, he’s very well-regarded," says Ed 
Skoudis, a vice president at the computer security company 
Predictive Systems and author of the anti-intrusion book Counter- 
Hack. "He's sincere, passionate, smart, with a good track record. 
Getting in and getting out without getting busted -- wow. And the 
thing that stands out about Adrian is that he's very open about the 
fact he's breaking the law. I don't want to get into his head, but he 
seems to think he’s OK because he follows the spirit, if not the letter, 
of the law. And you know what?" Skoudis gives a small chuckle. 
"Maybe there is some validity in the way Adrian does his thing, 
because his targets don't seem to disagree." 


That could change soon, however, and Lamo knows it. As it happens, 
one of the reasons I have such a hard time getting into Lamo's head, 
or even getting him on the phone, is because he's been preparing to 
announce, in a few days, weeks, or months -- whenever he decides 
the time is right -- his biggest hack yet. On the record, he defines his 
target as a “critical-infrastructure-related company"; off the record, 
he exhibits ample evidence of his repeated incursions into the 
corporation's internal system -- incursions that are almost bound to 
be extremely embarrassing to the firm. He admits giving considerable 
thought to the company's reputation for aggressively pursuing 
hackers, and has been lining up fallback plans -- asylum in a foreign 
country, hiding in the Deep South -- in case the company lives up to 
its reputation. “In terms of my personal sense of the intrusion and 
what it affects, I see this as more epic than anything I've worked on 
in the past,” Lamo says, his clipped, halting words staggering out like 
text across a screen. "There's a sense of rightness about it. I believe 
it's broader in scope, but it also has more potential to go terribly 
south." 


So why do it? That's what I'm dying to ask him, and because San 
Francisco is one of the few cities Lame comes close to calling home 
(his parents live outside Sacramento), he generally spends some 
portion of his winter and spring in the Bay Area. But I'm not at all 
surprised to hear, when I call him up, that he's still on the road. In 
fact, as we chat, Lamo is walking 20 minutes to the nearest wireless 


supe vee 
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Internet connection because, alas, the glue that binds his modem has 
melted from the heat of his laptop. "It's like T've always said, “If 
everyone had to walk 20 minutes to find an Internet connection, 
content on the Web would be so much better," Lamo jokes through 
the static of a fading cell-phone signal. 


We agree to postpone our chat again, until he's a bit more settled. 
“Stay out of trouble," he says before signing off. "Don't do anything I 
wouldn't do.” 


Adrian Lamo doesn't know if the Pacific Bell Network Operations 
Center has moved out of a particular building on Second Street, but 
the last time he checked, the combination for the center's electronic 
door lock was still 55755. 


After more than a year, I finally meet Lamo face to face on Presidents 
Day, He's staying outside Sacramento, and he agrees to hop on the 
bus and meet me at a coffee shop near the capital, if I'm willing to 
make the drive out from San Francisco. It's a hazy, chilled afternoon - 
- Lamo describes himself as "nocturnal," and you can't expect to 
catch him before 2 or 3 p.m. -- and the dusty, leaf-blown streets 
surrounding the Greyhound terminal downtown are largely deserted. 
Lamo shows up a half-hour late; he missed his scheduled bus, he 
explains, because he forgot his cell phone and had to retrieve it. He's 
wearing a black buttoned shirt, khaki pants, and sturdy brown boots, 
and his gaze is both intense and friendly, although he never, ever, 
asks questions and doesn’t answer all that are posed to him. Within 
minutes, he's tapping away at a black taptop, signing on (somehow) 
to a wireless connection. “I couldn't find any immediate reference to 
Matt Paimquist in the San Francisco Bay Area outside of articles," 
Lamo says, "so ..." He turns his screen so I can take a peek at some 
of the, ahem, research he's turned up. "I'm happy to report,” he says 
cheerfully, “that your account is in good standing." 


Although he conducted much of the work behind his most famous 
hacks at different Kinko's copy shops throughout downtown San 
Francisco, Lamo now prefers a wireless connection, so he can go 
online outdoors, on the steps of buiidings, whenever the mood strikes 
him. Some bums in Philadelphia, he says, know him as Hackin' Man. 
"There's nothing like having the guy who was bellowing about Jesus 
at the top of his lungs five minutes ago check his Hotmail account 
from your Palm Top," Lamo says with a grin, sipping from a cup of 
coffee. "I live for unusual situations, improbable things that wouldn't 
happen to anyone else." 


He's lived through plenty of those: His parents, who work in video 
production and as English-Spanish translators, moved around a lot 
when Lamo was a kid, He was born in Boston, and he spent much of 
his early life in Massachusetts and the Washington, D.C., area. “I like 
to say I was raised by a band of wandering gypsies, but that just 
wouldn't be factual,” says Lamo. “My upbringing was not transient in 
that sense. We had a roof over our heads -- I was always cared for 
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mastered its use.” 


in virtual trespassing. 


shrugs. “Really, everything since then has been fa 


that this is denied to me, and there's no way arou 


He pauses. “There's always a way around it.” 


the Bay Area during the dot-comness." 
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well." The family spent a few years in Lamo's father's native 
Colombia, then returned to the United States when Lamo's younger 
brother was born prematurely and needed medical attention here. His 
parents settled in the Bay Area in time for Adrian to start high school; 
he never finished. Following three unsuccessful stints at San 

Francisco schools (where, to no one's great surprise, he had some 
problems with authority), Lamo opted to get a GED instead. By this 
time he was 17, his parents had moved to Sacramento, a 
decided to remain behind on the streets of San Francisco. 


Adrian's parents, Mary Atwood and Mario Lama, have never been 
quoted in media reports about their son, but they agree to respond in 
writing to some of my questions. ("As long as they don't show you 
any baby pictures," Adrian grumbies.) I ask them several: What was 
he like as a kid? Are you proud of what he does? Do you ever just 
wish he'd get a "normal" job? What's the source of his unique outlook 
on fife? Mario and Mary, whom Adrian refers to as former “young 
radical types," avoid answering most of the questions directly, but 
they do respond with a few warm paragraphs about their son. 


"Since he was a baby, he had an outstanding intelligence and verbal 
ability,” they write. "By the time he was three, he was already 
completely bilingual (English/Spanish). He easily learned to read at 
home and always loved books. As a child, he wasn’t the type that 
tinkered with gadgets, although he did begin playing with Lego's at a 
very young age. ... When he was 6 years old, he received his first 
computer, a Commodore 64, from his grandmother, and soon 


Indeed, it was this Commodore -~ the first personal computer for so 
many American families in the 1980s -- that sparked Lamo'‘s interest 


He was playing a text-based adventure game, in the ancient era 
before full-color graphics, and became "intensely frustrated” because 
he couldn't get past a certain point. "I neglected to pick up the 
pebble-of-something, so consequently I couldn't get through the so- 
and-so,” Lamo recalls with a grimace. “after days of trying to get 
through, I said, ‘Fuck this,’ and I picked up the Commodore's manual 
and read about the list command, which shows the program code. 1 
rewrote that particular part to let me through, and that was that." He 
r versions of 
that, being unwilling to accept reality as it's presented to me, the idea 


rgel 


nd it.” 


After his parents moved to Sacramento, Lamo began drifting around 
the city, working at a few nonprofits, doing some security 
Levi Strauss. He lived in a furnished apartment for a while, although 
when he moved back out, plastic sheets still covered most of the 
furniture. "I never made a conscious decision to start bouncing 
around,” he says. "I just wasn't interested in finding an apartment in 


ind he'd 


work for 
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He discovered he could live on about $50 a week, plus or minus the 
occasional check from his parents or gift card from a sympathetic 
friend, and got what little income he needed through an odd bit of 
freelance computer work. He has even been an assistant to a private 
investigator. His lifestyle, needless to say, made It difficult to apply 
for, much less hold, a regular job, and he wasn't willing to abandon 
his wayfaring ways. He had begun hacking in high school -- where he 
got thrown out of the only computer class he ever took (to this day, 
his computer skills remain entirely self-taught) -- and decided to 
devote himself to exploring both the real and virtual worlds. “I'm just 
as likely to be wandering around an abandoned buiiding or crawling 
through a storm drain as Iam to be poking around something 
ontine," Lamo says. “And I think both of them are equally valid. I 
think me getting stuck in a storm drain in New Jersey is every bit as 
important as breaking into the New York Times." 


His parents, for their part, say they are pleased that Adrian has found 
an application for his unique talents; they don't discuss with me any 
concerns they might have about their son landing in prison. "We have 
always encouraged Adrian to be a critical thinker," they write, "and 
are proud of his intellect, and that he applies his skills to what he 
likes most, computer security.” 


Besides, they probably couldn't convince Lamo to change his line of 
work if they tried. “This is what I'm here to do," Lamo says, his iong, 
slender fingers still gliding across his keyboard in the Sacramento 
coffee shop, now suffused in a tate-afternoon glow that lends a bit 
more radiance to the hacker's near-translucent skin tone. "I think 
everything we do has ripples beyond what we see, even if the only 
thing that sees the rippies is the universe itself. I just have a real 
strong feeling that this is what I'm born for, and what I'm doing isn't 
wasted. I just feel compelied to explore.” 


A few minutes fater, a guy with a crew cut and a thick build enters 
the coffee shop; Lamo stops talking, shuts his laptop, and follows the 
guy with his eyes. “There is an FBI office in that building over there,” 
Lamo says, motioning out the window. "It's not in the building 
directory, but it's there, on the top floor.” 


With the kind of access Adrian Lamo stumbled across in 2001, almost 
by accident, any employee at WorldCom could have turned off the 
internal computer network for Bank of America. 


He’s eaten now; he feels better. Darkness has fallen outside the 
Embarcadero Center; it's a few weeks after we met in Sacramento. 
He's been out of touch again, “regrouping personally," as he puts it, 
and preparing for the hack he's about to announce. “I need to make 
sure I have cash on hand, places to go," Lamo says, and his tone 
hardens. "I want to make sure that, if things go south, they won't be 
able to say, “Lamo was hopelessly naive, that he was just sitting 
around in his bedroom at his parents’ house." 
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After a sleepless night and a long day, Lamo is about to head 
downstairs to a meeting of 2600: The Hacker Quarterly. He has 
occasionally contributed to the magazine, named after the 2600-hertz 
signal that enabled hackers in the 1970s to access AT&T's long- 
distance switching system and make free calls, and considers it his 
duty, when in San Francisco, to drop by the meeting and hobnob with 
his fellow hackers. Most of the dozen or so attendees tonight are 
males with backpacks, although one is a woman with gray hair, and 
the best T-shirt says: "I see dumb people." Before Lamo sidles up to 
the group, clustered in the plaza, he mutters, "My God, I started 
going to meetings in 1996 -- I feel old.” 
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A Duty to Hack 


«BACK Actually, Hacker Quarterly 
began publishing its tips, trade 
secrets, and commentaries way back 
in 1984, about the time computer 
espionage exploded into the national 
consciousness. The previous year had 
brought the popular film War Games, 
which starred Matthew Broderick as @ 
computer wiz kid who mistakenly 
cracks into the military's nuclear- 
combat simulator computer and 
saves the world by programming the 
machine to play tick-tack-toe. The 
first high-profile arrests of real 
hackers occurred around the same 
time, when the FBI busted six 
teenagers from Milwaukee known as 
the 414 Gang (named after the local 
area code), who broke into more than 
60 computers, including those at the 
Los Alamos National Laboratory and 
Sloan-Kettering Memoria! Institute. 


But the hacking tradition didn't start 
with criminality -- it started with 
graduate students at the 
Massachusetts Institute of Technology 
in the early 1960s. Tapping into the 
mainframe computer in the artificial 
intelligence lab, they pushed the 
boundaries of programs and earned 
the complimentary nickname 
“hacker.” The Internet, of course, 
remained largely unexplored until the 
persona!-computer boom of the 
1980s, and it only became a staple of 
American fife with the advent of e- 
commerce in the 1990s. As capital 
entered the flow of the information 
highway, hackers began finding more 
and more pathways closed to them, 
and the relationship between 
companies and intruders grew 


Paola Vescla 


Standing outside a 
Greyhound terminal with 
his Palm Top, Lamo says 
he always drifts back to 
San Francisco because the 
city is "big enough to 
wander in but smali 
enough to not be 
impersonal." 
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increasingly bitter. 

Letters 
"Malicious hackers like to illustrate Letters to the Editor 
the impact of what happens when Week of April 16, 2003 
they're ignored," says Douglas 
thomas, an associate professor at the University of Southern 
California and the author of Hacker Culture, which explores the 
history and psychology of the movement. "The benevolent hacker 
says, ‘Your fly's open, here’s how to close it.' The thing I find 
interesting [about Adrian] is the idea of a hacker as a kind of 
consumer reporter on the world. He's doing a public service, finding 
these holes, and that seems to have a noble spirit to it.” 


But it's still a felony under several federal laws, most notably the 
Computer Fraud and Abuse Act, which was passed in 1984 and has 
been amended several times since. After the terrorist attacks of Sept. 
11, 2001, Attorney General John Ashcroft strengthened that law, and 
others, through the Patriot Act, which expanded the government's 
powers to pursue alleged criminals online, listen to wiretaps, and 
monitor Internet usage. Although many in government and industry 
have downplayed the threat of cyberattacks from terrorist groups like 
al Qaeda, regular hackers do plenty of damage. According to the San 
Francisco-based Computer Security Institute's seventh annual 
Computer Crime and Security Survey -- which polis more than 500 
U.S. corporations, government agencies, financial and medical 
institutions, and universities -- 90 percent of the respondents 
reported computer security breaches in 2002, and 80 percent said 
they suffered financial losses. The 223 respondents who were willing 
or able to quantify the damage done by hackers reported a grand 
total of $455 million in losses; the institute estimates that hackers did 
weil more than $1 billion of damage in the United States last year. 


“Tm not a jurist, but 1 recognize that what T'm doing is illegal, and I 
don't think the way I'm doing it makes it any righter than how anyone 
else would do it," Lamo says. “I'm sure someone somewhere has 
gotten fired because of what I do. These things happen. I've run 
networks myself and I've been intruded upon, so no one can say rt 
don't know how it is. But as long as I'm doing it, 1 feel it's important 
to set a precedent so companies say, ‘You know, everything didn't go 
to hell after we let him go.’* 


Although Lamo seeks a cordial relationship with the companies he 
hacks -- some have even offered him a job, though he turns them 
down because he doesn't want peopie to think he's profiting from his 
expioits -- and takes pride in showing corporations his points of 
access, he's not naive enough to think his relative benevoience will 
get him off the hook. In fact, Lamo -- whe says with absolute 
sincerity, "I never assume I'm not being surveilled" -- even posted an 
anonymous screed to an Internet discussion board in defense of the 
Patriot Act. "Many of you armchair attorneys genera! out there might 
not be so quick to fault the measures being taken now if you 
suddenly found yourseif saddled with the responsibility of securing 
the lives of millions of your fellow citizens," he wrote. "As someone 
who does things that are illegal, 'd rather not have increased 
scrutiny. ... However, it's a no-win for a decision maker like Ashcroft. 
I don't know what I'd do if I were him. Neither do any of you. You 


FBI(19-€v-1495)-182 


6/20/2003 


http://www .sfweekly.com/issues/2003-04-16/feature.html/2/index.html 


* DE WeeRLY | SIWECKIY.COM | INGWS . CoatULG m aruLy ty ttaways masses semen 


v 
a 


decisions that may save or cost lives is hard.” 


themselves. 


be like a bull in a china shop.” 


says. 


the Swiss Army Knife of electronic devices." 


schedule (or lack thereof) has been harder on him 


Dew Code Red. 
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don't know* what you'd do in someone else's shoes until you 
actually have to face their decisions. Moralization is easy. Making 


There are many in the computer security industry who, while freely 

admitting they find some form of nobility in Lamo's peculiar brand of 
hacking, worry that those who follow his lead may do so n 
they admire his spirit, but because they want to grab some headlines 


“Benevolent hackers have been a piece of the computer underground 
for years," says Skoudis of Predictive Systems. "Adrian doesn't leave 
me ifl at ease ... he's too smart. My fear is that it’s not reproducible. 
Adrian does his thing, but Adrian is pretty decent about what he 
does; someone who doesn't have his skilis, or his personality, could 


FBI officials, meanwhile, won't say whether the bureau has ever 
investigated any of Lamo's intrusions. "There's no way I'd be able to 
tell you that," a spokeswoman in the FBI's Washington, D.C., office 


At one hotel in Washington, D.C., there's a vending machine that 
dispenses 20 cents in nickels every time it's hit with a Taser, an 
electric stun-gun meant for personal defense that is one of the more 
useful things Adrian Lamo has ever owned. "You never know what 
something's going to do when you Tase it, * Lamo enthuses. “It 


It's a mild Sunday evening in late March, and Lamo has cashed in a 
gift card at Banana Republic for a new black jacket, which he wears 
over his usual dun-colored pants and boots. He's also sporting a new 
black shoulder bag -- compiete with a sleeve on the strap 
phone -- that he bought, with another gift card, at the Gap. Protests 
against Operation Iraqi Freedom have roiled these streets in 
downtown San Francisco for much of the past two weeks, but Lamo 
has been away from the city, recuperating, again, from too many 
sleepless nights. Since turning 22, Lamo has noticed that his sleep 
and as we walk 
down the mostly empty streets, he stops to gaze in the window of a 
health food store. He's heard that some herbs and vitamins have 
antl-convulsive properties, which might help him stave off the spasms 
he suffers when he doesn't get enough rest. The convulsions are the 
result of a neurological disorder, which Lamo says stems from an 
amphetamine overdose he endured fast year. As with most of the 
steady influences on Lamo's life, drug use is something he regards as 
a necessary element of his lifestyie -- which also includes mainlining 
caffeine-laced energy drinks like Red Bull, Joit Cola, and Mountain 
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“y've resisted including this in news reports because T think it would 
make me intolerable to the government if I was advocating both 
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intrusion and drug use, but substances that disassociate you from 
your senses have played a big part in my life," Lamo says. "The point, 
with substances, has always been to show myself where I can go 
without them. Drugs are not an indispensable part of my fife. But 
there are times when I'd rather stay up until the next bus comes 
instead of curling up and finding my backpack gone when I wake. 
There are times I don't want to feel the pain.” 


He pauses, stops on a corner of the sidewalk in the Financial District, 
and waves his hand toward the nearest storefront. "This is my historic 
Kinko's," he says. "A great many of my compromises occurred here. fF 
believe it's still 24-hours ..." Peering at the sign on the door, he steps 
back, aghast. “Goddamn it, it's not! How could they do this to me?" 
He shakes his head, then slips back into his role as tour guide. “It 
does not have a restroom but it has a vending machine, so I can keep 
the Code Red coming. So much miscellaneous stuff has happened 
from this Kinko's, from that far desk over there. Most of the 
exploration for the WorldCom intrusion happened here." 


Before he penetrated the New York Times, Lamo's incursion into the 
troubled telecom giant WorldCom was perhaps his greatest coup. It 
was vintage Lamo: He was drifting around the company’s site, with 
no preformed plans to hack it, when one thing led to another. Over a 
handful of all-day sprees -- "whenever I'd get bored and remember 
WorldCom," as he puts it -- Lamo got access to the company's 
internal system via open proxy servers, dedicated machines that act 
as a go-between for employees’ computers and the Internet. This, 
too, is his trademark. Whereas most hackers obsess over known 
software vulnerabilities, endlessly scanning a company's security 
applications in the hopes of finding a random glitch, Lamo sneaks 
through these more nebulous, less intentionally geeky, heies. When 
brought online, proxy servers are often misconfigured, both accepting 
and forwarding connections from the outside as well as the inside, 
and Lamo can change his browser's preferences te match those of the 
proxy server. 


Open proxy servers don't require a username or password, and once 
inside a company's system, Lamo hunts down passwords that enable 
him to view other pages on the company's own intranet. And this is 
one of Lamo's fundamentai gripes: When you put a network, any 
network, online, you accept the responsibility for securing it, he says. 
And spending millions of dollars on front-door security software 
doesn't mean anything if the back door is wide open. 


Lamo broke the news of his intrusion into WorldCom through the Web 
site SecurityFocus.com, and officials at the telecom company said 
they appreciated Lamo's help in drawing attention to the problems 
with their system. (It took a weekend of Lamo's assistance to close 
the holes.) "All these companies I've compromised, they've never had 
a clue until I told them," says Lamo, who has a computer screen-shot 
of WorldCom's stock falling the day he disclosed his hack. "To an 
extent, it's because of my approach. Classic intrusion software looks 
for an attack -- nothing I do looks like an attack. It's the same stuff a 
user would do, and you can’t determine what the intent of a user is.” 
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friendships bloom inte something more. 


changing people's lives so drastically. You know, 


happened to them." 


either.” 


- process of doing whatever he's doing," he says. 


much as I do. I suspect it does." 


worth It." 
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His nomadic lifestyle is another reason he's never been caught; Lamo 
always works alone, and he traveis without companionship. Given his 
admitted contempt for returning phone calls promptly -- "Some 
people are rudely late," Lamo says, “t try to be absurdly late” -- it's 
hard for him to make personal relationships last. Although he's got a 
fot of friends across the country, he usually leaves before those 


"In a way, I'm sort of fated to be @ bright, fast-moving object in 
people's lives," Lamo tells me one night. "I tend to enter abruptly, 
make massive change in their life, and leave just as abruptly. I keep 
in touch with peopte, but I try not to fet my words be taken with 
inappropriate weight by people around me. I've seen the effects of 
people's long-term association with me, and I just fee! strange about 
people who were 
nice suburban boys two years ago, and now their mom wonders what 


A few evenings later, I meet a friend of Adrian in downtown San 
Francisco. His name is Nevin Williams, and he's a 32-year-old 

network administrator in a red sweat shirt that says “Canada.” They 
met through a mutual friend in the computer world, and it's a credit 
to both Williams and Lame that they still talk: Williams, as it happens, 
was lead engineer at Excite@Home when Lama hacked the system 
and added his name as a security consuitant to the company 
directory. Williams didn’t hold it against him, and Lamo has since 
crashed many a night at Williams' house in the suburbs. Although he 
cautions Lamo about the risks, Williams doesn't try to change his 
friend's path. "With Adrian, it's a spiritual thing. This is his religion. 
It's something he believes in, and he's not two-faced, This is genuine. 
Many people don’t understand it -- I don’t claim to understand it, 


Williams shrugs. “I just request he doesn't use my networks in the 
"and I really hope 
T’'m not with him when the FBI or the CIA swoops in.” 


For the past several years, there's been a bench warrant out for 
Adrian Lamo in Sacramento County. He got it several years ago for 
riding public transportation without a ticket. "There's irony in the fact 
that the whole time I was doing al these crimes, 
take me in,” Lamo says. "I hope the universe enjoys absurdity as 


they had license to 


On a windy afterncon in Yerba Buena Gardens, Lamo and I settle in a 
rare patch of sun ona round stone bench. He's talking into his cell 
phone to Williams. “I'm sure it's not messy by my standards," Lamo 
assures him, "I'm used to abandoned buildings." After he hangs up 
the phone, Lamo sighs, and says, “I hope I don't die of asbestos 
poisoning a few years down the road, but if I do, it will have been 
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His recent birthday, I think, has caused Lamo to question his 
mortality. He seems on edge, and when I ask him about his 
impending disclosure, he says he's not dissuaded by the target 
company’s reputation for hunting down hackers -- “Intimidation is not 
a substitute for security,” he insists -- but admits to weighing the 
ramifications. At one point, he stares into the sun, his brows locked, 
and considers a question about how he would fare in jail. 


"T don't know; I could be happy indefinitely sitting here in the sun, 
and this could be a prison yard if you put walls around it," he says at 
last. "But prison would curtail what I do, and it would be unpleasant." 


So why go through with it? He gives his standard line: "This is what I 
do, this is the role I was born to play.” And he refers, as he often 
does, to a quote from Frank Herbert's 1965 science-fiction epic Dune, 
the story of a young man who becomes a messiah. At home that 
night, I look up the passage: "The person who experiences greatness 
must have a feeling for the myth he is in. ... And he must have a 
strong sense of the sardonic. This is what uncouples him from belief 
in his own pretensions. The sardonic is all that permits him to move 
within himself. Without this quality, even occasional greatness will 
destroy a man.” 


Only then do I understand: In his mind, Lamo’s life is a new kind of 
story for the Information Age, the quasi-mythic saga of a traveler, 
perhaps not so different from Dune's, whose adventures are neither 
wholly corporal nor wholly virtual. If Lamo spends too much time 
considering his actions, he steps too boldly out of the character he's 
created. And more than anything, I think, Lemo wants to know how 
his story will end. 


In that respect, at least, he's not so different from the rest of us. 
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Title: ADRIAN LAMO; . 
New York Times-Victim; 
Computer Intrusion; 
OO :NY 


Synopsis: Request canvass of sources involved in computer 
intrusion matters to locate ADRIAN LAMO 


Details: ADRIAN LAMO is a twenty two (22) year old male, who 
commits unauthorized computer intrusions into major corporations. 
LAMO is labeled in the media as the “homeless hacker". He 
considers himself a "white hat hacker". Investigation by the New 
York Office has revealed that LAMO is a "black hat hacker", an 
individual who bréaks into a computer system with the purpose of 
inflicting damage or stealing data. Each time LAMO hacks a major 
corporation, he first alerts friends in the media. The friends 
in the media then contact the victim company and ask for comment 
for their story. This is first notification the victim company 
receives that their network security has been breached. 


In September 2001, LAMO hacked YAHOO! and rewrote the 
text of a YAHOO! News article. LAMO gained access through the 
portal's web-based production tools and modified a news story 
about DMITRY SKLYAROV, a Russian computer programmer facing 
federal criminal charges. LAMO used a free internet connection 
at KINKOS to commit the hack. YAHOO! was informed of the breach 
after being contacted by who 
was contacted by LAMO. was convicted in 1990's by the bIC -S 
FBI for committing unauthorized computer intrusions. 
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2001, LAMO contacted the reportex,[__] 

ko inform him that he had gained 
unauthorized access into a MICROSOFT customer service database. 
LAMO had gained access to MICROSOFT's database is September 2001 
but choose not to disclose his access until October 2001. LAMO 
utilized a vulnerability in MICROSOFT's network that allowed an 
unpublished Internet Protocol (IP) address to be entered into a b6 -5 
web browser. The IP address provided access to records of the bic -5 
individuals who had purchased products and services from 
MICROSOFT. The first notification of this unauthorized intrusion 
was conducted by| who contacted MICROSOFT asking them for a 


comment to his story he was writing regarding the hack. 

MICROSOFT confixmed the hack anf 

| described the incident as “an error that toa 
reach Of privacy, against our privacy policy". 


LAMO contacted the reporter, 
to inform him that he had gained 
unauthorized access into MCI WORLDCOM's internal network. LAMO 
gained access to WORLDCOM's internal network in October 2001 but 
choose not to disclose his access until December 2001. LAMO 
provided internal screen captures to WORLDCOM to prove he was the pg -5 


hacker. The screen captures from WORLDCOM's internal network bIC —5 
state, "Not to be reproduced in any manner or disclosed to 
unauthorized individuals". AMO gained access to WORLDCOM's 


internal network using a free internet connection at KINKOS. 

LAMO exploited a vulnerability in a WORLDCOM proxy server to gain 
unauthorized access to their network. After committing the hack 
and reporting it told LAMO commented "The downside is, I'm 
running out of major US Corporations". Also, one of LAMO's 
prized possessions is a screen capture of WORLDCOM's stock price 
falling after he announced he had hacked the company. 


In February 2002, LAMO contacted the reporter,[ sd 
to inform him that he had gained 

unauthorized access into SBC COMMUNICATIONS, LAMO gained access 56 -5 
to SBC COMMUNICATIONS network in December 2001 but choose not to b7c 
disclose his access until February 2002. LAMO utilized an ~ 
exploit to gain access to SBC's internal network. LAMO used a 
free internet connection at KINKO's to perform the hack. LAMO 
gained access to usernames, passwords, telephone numbers, 
addresses and other sensitive customer information. 


In February 2002, LAMO discovered several misconfigured - og 
proxy servers acting as doorways between the public Internet and be -5 
the NEW YORK ES private intranet. LAMO contacted of b7IC -5 
to inform him that he had gained unauthorized 
access into The NEW YORK TIMES intranet. LAMO utilized the proxy 
servers to gain access to the NEW YORK TIMES network. Once on 
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the network, LAMO cracked a password for a userid with supervisor 
rights. Utilizing this userid he was able to broaden his access 
as well as perform certain functions within the network. LAMO 
created four (4) Lexis/Nexus accounts off of the NEW YORK TIMES 
intranet and utilized these accounts for himself and/or friends 
to run over 3,000 searches of individuals, address and/or court 
documents. 


LAMO has committed other computer intrusions into 
several other corporations such as AOL: and EXCITE@HOME. Each 
time LAMO commits a computer intrusion on a high profile 
organization, he reports the vulnerability and intrusion to the 
media causing a distrust of the company's clients. The above 
mentioned corporations have lost significant money and trust of 
their clients due to LAMO's actions. 


In the enclosed San Francisco Weekly article, dated 
April 16, 2003, LAMO states "he is preparing to announce, ina 
few days, weeks or months -- whenever he decides the time is 
vight -- his biggest hack yet. On the record, he defines his 
target as a "critical-infrastructure-related company"; off the 
record, he exhibits ample evidence of his repeated incursions 
into the corporations internal system." NYO believes that LAMO 
is a threat to the infrastructure of the United States. 


The NYO along with the Southern District of New York 
(SDNY) completed a sealed complaint charging LAMO with his 
unauthorized access into WORLDCOM, NEW YORK TIMES, LEXIS/NEXUS, 
SBC COMMUNICATIONS and MICROSOFT. Based on the complaint, a 
warrant has been issued for the arrest of LAMO. 


The NYO received information that LAMO was to attend 
Def Con in Las Vegas, Nevada from August 1-3, 2003. LAMO was bIE -1 


regist his registration on June 30, 
200 
i led court order for a pen 
S i attempt b3 -4 


Due to LAMO's lack of residence and homeless lifestyle, 
the NYO is requesting assistance from any/all sources who are 
familiar with the technical/hacker community in attempting to 
locate LAMO. Any information pertaining to his whereabouts would 
be helpful to apprehending him. AMO recently threatened a major 
infrastructure and the NYO believes that if LAMO believes he is 
going to be arrested he will hack the major infrastructure and go 
underground as threatened in the attached article. 
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Descriptive Data: 


Main Subject. 


Name - 
Last: LAMO 
First: ADRIAN 
Middle: ALFONSO 
Race: Ww 
Sex: M 
DOB: 02/20/1981 
soc: 042-74-6804 
soc: 669-16-9432 
Phone #: 415-505-HACK (4225) 
Miscellaneous - NCIC#: W404646227 
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LEAD (s) ¢ 
Set Lead 1: (Action) 


ALL RECEIVING OFFICES 


The NYO request all sources in the technical/hacker 
community be queried regarding the whereabouts of ADRIAN LAMO. 
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Title: ADRIAN LAMO; 
New York Times-Victim; 
Computer Intrusion; 
OO: NY 


Synopsis: Update to the ADRIAN LAMO investigation 


| Administrative: Reference EC dated 7/2/2003 

Reference EC dated 7/21/2003 

Reference email captioned "Adrian Lamo Update" 
sent 8/7/2003 


Details:—.[fhe New York Office (NYO) along with the Southern 
Tstricty of "New York (SDNY) have obtained an arrest warrant for 
ADRIAN iO b#sed on a complaint. The complaint charges LAMO 

ith gom intrusion and unauthorized access into the NEW YORK 
TIMES and LEXIS/NEXUS. The complaint further specifies LAMO's 
other hacks such as WORLDCOM, SBC, YAHOO, MICROSOFT, YAHOO, 
EXCITE@HOME, and CINGULAR all of which LAMO has admitted to on 
videotaped interviews. 


Members of the NYO's squad DT-5 attended the recent DEF 
CON in Las Vegas, NV from August 1-3, 2003 with the purpose of 
locating and apprehending LAMO. LAMO was registered for the 
event and had reserved a hotel for his attendance at the event 
but failed to appear. 


Today 


ourt order to place a b3 -4 
pen register on 


The NYO is querying all technical/hacking community 
sources to attempt to locate LAMO. 


To date, the NYO has not located LAMO and therefore he 
has not been apprehended. Once LAMO is apprehended, writer will 
contact all above mentioned offices and Agents so that interviews 
can be conducted. 


The NYO understands that certain offices have Federal 
Grand Jury (FGJ) subpoenas issued for_particular individuals they b3 -1 
will be interviewing with a date of| ~~] The NYO 
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subpoenas once LAMO is apprehended. 
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(] FBI Wanted Person entry in NCICFW , does not contain a FBI number; therefore, only a name stop 
has been placed in the Criminal Justice Information Services (CHIS) Division Automated Name Index File. Check the Interstate 
Identification Index (II) via NCIC using all available descriptors to retrieve identification records possibly identical with your fugitive. 

If record located positively identifiable with your fugitive, modify your NCIC entry to include his/her FBI number. This will resuft in a 
CHIS Division stop placed in fugitive’s fingerprint record. If no record located through II; however, fingerprints of fugitive are available, 

> forward fingerprints via electronic communication to the Identification and Investigative Services Section, CJIS Division for placement of a 
positive fingerprint stop. 


Yaak of the CJIS Division’s Automated Name Index File did not disclose a fingerprint record for the above-named fugitive. Endeavor 
to develop any additional data that will identify this individual with a fingerprint record. 


A name stop has been placed in the CJIS Division’s Automated Name Index File in your behalf. Enclosed is a copy of a civil fingerprint 
card which may be identical with your fugitive. Your office should determine if these fingerprints are identical with your fugitive and 
resubmit via electronic communication within 30 days to Identification and Investigative Services Section, CJIS Division for placement of a 
Positive fingerprint stop. 


1 Modify NCIC Wanted Person entry#'W . t0 include 
EBI number NCIC Classification: 


Fingerprint Classification 
Enc. 


Wentiftcation and Investigative Services Section i 
Criminal Justice Information Services Division pL 
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For Further Instructions See: MAOP, Part I, Sections 3-5 thru 3-5.3. 


KNOWN CRIMINALS 


SK Organizer 
SL Business Manager 
5M Financial Secretary 
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ederal [] Local [International 
Complaint Date: _ ©. fa) 
Check if Civil Rico Complaint I] 
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Indictment Date: 


B. Locate/ Arrest 
0 Federal ( Local [international 
Subject Priority: OA OB OC 
Locate Date: 
Arrest Date: 


F. Conviction 


{Federal [] Locat [ international 
Conviction Date: 


Subject Deseription Code: 

For 6F, G, H-Include Agency Code 

i Felony or — (] Misdemeanor 
O Plea or (Q Trial . 
State: Judicial District: 


J. Civil Rico Matters Date: 
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Other Civil Matters Date:, 
Judgment 
Judicial! Outcome LK 
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Suspension: Years Months 


G. U.S, Code Violation 
Required for sections A.B,Fand J 


10 Subject Resisted Arrest (Federal Only) : 
{J Subject Arrested was Armed Tite: Section in # “ee 
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O Federal = Local 


D. Recovery/Restitution/PELP X 
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Recovery Date: 
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Code * v Amount $. 

PELP Date: 

Code * v Amount $, 
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Released by: [Terrorist (] Other 
Number of Hostages: 
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ALL INFSRMATICN CONTAINED 
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H. Sentence Date: 
Sentence Type: 


In Jail: Years. Months 
Suspended: Years. Months __ 
Probation: Years. Months __ 
Fines: $. 


K. Administrative Sanction Date: 
Subject Desoription Code 


Type: Length: 
Suspension [J] Permanent 

( Debarment or 

Ol Injunction Year. Months 


L. Asset Seizure Date: 
Asset Forteiture Dat 
CATS# Mandatory 
Circle below one of the three asset forfeiture: 
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Disruption Date: 
Dismantlement Date: 
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N. Drug Seizures “Date: 
Drug Code * 
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FDIN ao 
Do not indicate $ value in Section D 


Code 


0. Child Victim Information 
Chit located/identified Date: 


Ol Living 1D Deceased 
PB Subject Information - Required for all blocks excluding block D (Recovery/PELP), blocks £, I, L, and N. 
Name Race * Sex | Date of Birth | Social Security No. {if avaiable) 
Addan Lam wo | ws lalsolei | oya-qy-@80H 


For Indictments/Convictions only: 


Complete FD-515a, Side 1 Blocks A-C onty. 


Subject related to an LCN, Asian Organized Crime (AOC), italian Organized Crime (IOC), Russian/Eastern European, Caribbean, or Nigetian Organized Crime Group - 
Complete FD-515a, Side 4 Blocks A-E mandatory, F-H as appropriate. 


C1 Subject reiated to an OC/Drug Organization, a VCMO Program National Gang Strategy target group, or a VCMO Program National Priority Initiative target group - 


X Additional information may be added by attaching another form or a plain sheet of paper for additional entries. 


+ See codes on reverse side. 


Serial_ No. of FD-515 


¥ Requires that an explanation be attached and toaded into ISRAA for recovery over $1m and PELP over $5, disruption, dismantiement, bate Seizures. 
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MARK F. MENDELSOHN 
Assistant United States Attorney 


Before: | HONORABLE RONALD L. ELLIS pugs 
United States Magistrate Judge ‘ b7c -1 
Southern District of New York 


UNITED STATES OF AMERICA 7 TO BE FILED 
UNDER SEAL 


COMPLAINT 


: Violations of 
18 U.S.C. 

‘ §§ 1030 (a) (5) (A) (ii) 
-and 1029 (a) (2) 


COUNTY OF OFFENSE: 
Defendant. z New York 


SOUTHERN DISTRICT OF NEW YORK, ss.: 


bé -1 


being duly sworn, deposes and says bie -1 


that she is a Special Agent of the Federal Bureau of 
Investigation. and charges as follows: 


COUNT ONE 


t. From in or about February 2002 through in or about 
April 2002, in the Southern District of New York and elsewhere, 
ADRIAN LAMO, the defendant, intentionally accessed a protected 
computer without authorization and, as a result of such conduct, 
recklessly caused damage to 1 and more persons during a 1-year 
period aggregating at least $5,000 in value, to wit, LAMO, 
‘without the knowledge or authorization of the New York Times Co., 
Inc. (the “New York Times”), repeatedly accessed the New York 
Times’ private intranet, and altered the contents of New York 
Times databases including a database containing the personal 
information of contributors to the New York Times’ Op-Ed page, 
and by such conduct caused a loss resulting in damage to the New 
York Times in excess of $25,000 during a one-year period. 


(Title 18, United States Code, Section 1030 (a) (5) (A) (id) .) 
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COUNT TWO 


. 2. From in or about February 2002 through in or about 
April 2002, in the Southern District of New York and elsewhere, 
ADRIAN LAMO, the defendant, knowingly and with intent to defraud 
trafficked in and used one and more unauthorized access devices 
during a one-year period, and by such conduct obtained anything 
of value aggregating $1,000 and more during that period, to wit, 
LAMO created, and subsequently used, approximately five user 
identification namés and passwords under the New York Times’ 
account with the electronic information service LexisNexis, and 
by such conduct obtained LexisNexis search services valued in 
excess of $300,000 during a one-year period. 


(Title 18, United States Code, Section 1029(a) (2) .) 


The bases for-the deponent’s knowledge and the 
foregoing charges are, in part, as follows: 


1. I am a Special Agent with the Federal Bureau of 
Investigation ("FBI") assigned to the Cybercrime Task Force of 
the FBI's New York Field Division. I have been so employed for 
approximately two years, and have been an agent of the FBI for 
‘approximately six and one-half years. In addition, I have an 
undergraduate degree in computer science. In the course of my 
career with the FBI, I have participated in the investigation and 
prosecution of numerous crimes involving unauthorized access of 
protected computers. 


2. I have participated in the investigation of this 
matter, and I am familiar with the information contained in this 
affidavit based on my own personal participation in the 
investigation, my review of documents and computer records, and 
conversations I have had with other law enforcement agents and 
other individuals. Because this affidavit is submitted for the 
limited purpose of establishing probable cause to arrest ADRIAN 
LAMO, the defendant, I have not included herein the.details of 
every aspect of the investigation. Where the actions, 
conversations, and statements of others are related herein, they 
are related in substance and in part, except where otherwise 
indicated. 


3. Through my training and experience as an FBI 
agent, I am familiar with “hackers” and “hacking.” In general, 
hackers discover and explore vulnerabilities and security 
weaknesses in computer networks and software. Hackers carry out 
their activities using hacker tools that can either be custom 
written software code or, as is more common, software readily 
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available for download on the internet or for purchase. 


The New York Times Intrusion 


4. In or about late February 2002, I read an article 
on website SecurityFocus.com dated February 26, 2002 and entitled 
“New York Times Internal Network Hacked” (the “Article”). The 
Article reported that ADRIAN LAMO, the defendant, had hacked into 
the New York Times‘ private intranet? (the “NYT Intranet”) and 
accessed, among other things, a database containing personal 
information (including home telephone numbers and Social Security 
numbers) for over 3,000 contributors to the New York Times’ Op-Ed 
page. The Article further stated that LAMO had altered that 
database by adding a record for ‘Adrian Lamo” along with such 
personal information as his cellular telephone number and email 
address, and listing his expertise as “computer hacking, national 
security, communications intelligence.” According to the 
Article, LAMO admitted to the author of the Article in the course 
of an interview that LAMO was responsible for the New York Times~ 
intrusion. LAMO also described in detail how he had gained 
access to the system through a proxy server?; and 
detailed additional conduct undertaken while inside the NYT 
Intranet. 


5. In or about late February 2002, I contacted an 
employee of The New York Times (“NYT Representative One”) 
regarding the intrustion described in the Article. NYT 
Representative One informed me of the following, among other 
things: 


{a) On February 26, 2002 -- prior to the publication of 
the Article later that day -- the author of the Article contacted 
NYT Representative One and stated that ADRIAN LAMO, the 
defendant, had gained access to the NYT Intranet; that LAMO was 
able to download the Social Security numbers of New York Times 


2 An intranet is a computer network belonging to an 


organization, usually a corporation, accessible only by the 
organization's members, employees, or others with authorization. 
bs A ‘server" generally is a computer or device on a 
network that manages network resources; for example, a file 
server is a computer storage device dedicated to storing files. 
A “proxy server” is'a server that sits between a client 
application, such as a web browser (i.e., Netscape, Internet 
Explorer) and a server. Proxy servers have two main purposes: 
(1) to improve network performance; and (2) to filter requests. 


me Be 
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employees and personal information regarding 3,000 contributors 
to the New York Times Op-Ed page; that LAMO had accessed 
information regarding New York Times home delivery subscribers; 
and that LAMO had gained this access to the NYT Intranet through 
an open proxy server. The author of the Article provided the 
Internet Protocol addresses? (“IP addresses”) for seven proxy 
servers allegedly accessed by LAMO. The author of the Article 
stated that his source, i.e. LAMO, had provided screen captures’ 
showing internal images of the NYT Intranet, along with other 
information confirming the intrusion. The author of the Article 
also provided LAMO’s cellular telephone number -- (415) 505-HACK® 
-- to NYT Representative One. 


{b) Following the initial conversation with the author of 
the Article, the New York Times conducted an internal 
investigation into the alleged intrusion and confirmed that an 
unauthorized intruder had accessed the NYT Intranet using a proxy 
server® that was among the seven identified by the author of the 
Article.’ The investigation revealed that the intruder had 


3 An Internet Protocal or IP address is a unique numeric 


address use by computers on the Internet to communicate. 

‘ A “screen capture” is an electronic image, something 
like a digital snapshot, of an individual’s computer screen at a 
particular moment in time. 

5 I have obtained and reviewed subscriber and billing 
records from the cellular telephone company that provides service 
to telephone number (415) 505-HACK. Those records reflect that 
the telephone is subscribed to by an individual with the ljast 
name Lamo, with a mailing address in northern Ca, 


bIC 


I have determj indivi b7E 
ing address is believe to be the 
defendant. In addition, LAMO maintains a website at 


http: //adrian. adrian.ord. On that website, LAMO lists his 
telephone number as (415) 505-HACK, 


6 A representative of the New York Times has advised ‘me 


that this proxy server is located in Manhattan. 
? Based on my training and experience, I have learned 
that a software tool called “Proxy Hunter” is widely used by 
hackers to identify unsecured proxy servers on the internet. In 
connection with a different computer intrusion of MCI WorldCom, 


-4- 


FBI(19-cv-1495)-230 


accessed a New York Times staff list; obtained the name and 
Social Security number of a former New York Times employee; and 
using that information logged onto the NYT Intranet as a 
“superuser” -- that is, a user with full administrative rights to 
access and make changes to the network. Using that superuser 
access, the intruder created another superuser account under the 
fictitious user name “Eric Yee.” The intruder then used the Eric 
Yee superuser account to access various sites within the NYT 
Intranet, including an administrative database of contact 
information for various public sources (the “administrative 
database”) and a database containing personal information and 
Social Security numbers for contributors to the New York Times 
Op-Ed page (the “Op-Ed database”). NYT Representative One 
advised me that the intruder Had altered the Op-Ed database, 
adding a record for “Adrian Lamo” and personal information such 
as Lamo‘s cellular telephone number (i.e., (415) 505-HACK) and 
email address, and listing his expertise as “computer hacking, 
national security, communications intelligence.” NYT 
Representative One also advised me that a similar record for 
‘Adrian Lamo” had been added to the administrative database. 


6. In or about late May 2002, another representative 
of “thie New York Times (“NYT Representative Two”) advised me that 
in or about May 2002, LexisNexis (an online subscription service 
that provides legal, news, public records and business 
information for a fee) had contacted the New York Times to report 
unusually high levels of activity associated with a number of the 
userids/passwords assigned to the New York Times’ user account 
with LexisNexis (the “compromised userids/passwords”). NYT 
Representative Two told me that the New York Times had 
subsequently conducted an internal investigation to determine who 
was responsible for the unusual activity. That investigation, 
including analysis of electronic logs relating to the NYT 
Intranet, revealed that each of the compromised userids/passwords 
was created by the account of the fictitious user Eric Yee that 

the intruder had created during the course of the unauthorized 
intrusion into the NYT Intranet. 


7. Representatives of The New York Times have 
provided me with copies of the following records pertaining to 
the intrusion, among others: 


discussed below in paragraph 15, it has been reported in the 
press that ADRIAN LAMO, the defendant, used Proxy Hunter to 
identify an unsecure proxy server, which he then used to access 
MCI WorldCom’s internal network. 
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(a) the New York Times administrative database (admin_db) 
and the Op-Ed database (Oped_db) as they existed prior to the 
intrusion; 

(b)} the New York Times administrative database (admin_db) 
and the Op-Ed database (Oped_db) as they existed after the 


intrusion; 


{c) log files* from the proxy server accessed by the 


intruder; 

(d) log files from various other servers on the NYT 
Intranet; 

{e) an email automatically generated by the New York 


Times’ computer network when a new user identification is created 
reflecting that the Eric Yee user identification was created on 
February 20, 2002 at 8:10 p.m. EST; and 


(£) the user identification numbers/passwords 
(“userids/passwords”) associated with five LexisNexis accounts 
created by the fictitious Eric Yee user account. 


8. I have analyzed the materials provided by the New 
York Times described in paragraph 7 above and, based on that 
analysis and conversations with various New York Times personnel, 
have determined the following: 


(a) New York Times server logs reflect that an intruder 
had compromised the NYT Intranet at least as early as February 
14, 2002. 


{b) Between on or about February 14, 2002 and on or about 
February 26, 2002, New York Times Intranet server logs reflect 
that an intruder repeatedly accessed the New York Times Intranet 
through a New York Times proxy server and queried various 
directories on the servers, modified news stories saved on the 
server, and modified various databases. 


(c) an email automatically generated on February 20, 2002 
at 8:10 p.m. EST by the New York Times computer network with the 
subject ‘Change in stafflist” reflects that at that date and time 
the intruder, using the superuser account of a former New York 
Times employee, created a new superuser account under the 


8 hog files lists actions that have occurred in 
connection with a computer server. For example, Web servers 
maintain log files listing every request made to the server. 
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fictitious name Eric Yee. 


(d) New York Times server logs reflect that on February 
.20, 2002 at 9:30 p.m. EST the intruder logged on using the newly 
created Eric Yee superuser account and then proceeded to add a 
record to a New York Times administrative database under the name 
“Adrian Lamo.” 


(ea) New York Times server logs reflect that on February 
20, 2002, at 10:41 p.m. EST the intruder, still logged into the 
Eric Yee superuser account, added a record for “Adrian Lamo” to 
the New York Times Op-Ed database, a database of biographical and 
other personal information regarding contributors to the Op-Ed 
‘page. 


: 9. A representative of the New York Times had advised 
me that the New York Times has spent in excess of $25,000 
confirming, assessing, and repairing the damage caused by the 
computer intrusion described herein. 


10. In or about early June 2002, I spoke with a 
representative of LexisNexis (the “LexisNexis Representative”) on 
a number of occasions. The LexisNexis Representative advised me 
that five userids/passwords under the New York Times’ account 
with LexisNexis had been used to conduct more than 3,000 searches 
over a period of three months. The five userids were 
TOOMANYSECRETS, PROTAGONIST, LOCUST, VAISHNAV and NU1UJB. The 
LexisNexis representative also advised me that during the month 
of February 2002, the searches conducted by these five 
userids/passwords ‘represented approximately 18% of all searches 
performed under the New York Times account. The LexisNexis 
Representative advised me that he had communicated with the New 
York Times about the activity under the compromised 
userids/passwords and confirmed that the userids/passwords were 
created using the fictitious Eric Yee user account. The 
LexisNexis Representative advised me that these userids/passwords 
had been used to access LexisNexis services from, among other 
places, IP addresses associated with two Kinko’s locations, one 
in Oxnard, California and one in Sacramento Valley, California.*® 
The LexisNexis Representative further advised me that the charges 
incurred through the use of the five compromised 
userids/passwords amounted to approximately $300,000. 


, In a number of articles published by reporters who have 
interviewed LAMO, it is reported that LAMO carried out many of 
his computer intrusions from his laptop at a Kinko’s location. 
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11. The LexisNexis Representative provided me with 
copies of the log files pertaining to userids TOOMANYSECRETS, 
PROTAGONIST, LOCUST, VAISHNAV, and NU1UJB, including the 
following information: (a) date and time stamp; (b) IP address 
that accessed the userid; (c) the query entered; (d) the 
LexisNexis database searched; (e) the type of search; and (f) how 
the account was accessed, e.g. through the internet or through a 
network such as the New York Times’ Intranet. 


12. I have reviewed the LexisNexis log files 
identified above and. based on that review and my conversations 
with LexisNexis personnel have determined the following: 


{a} searches were performed in various different 
LexisNexis libraries for the following, among other queries: 


(1) “Adrian Lamo”; 


{2} various other individuals who have the last name 
“Lamo” or who, base “ rch using various bIE -2 
databases iueiiaingh = =] formerly had the 
last name “Lamo”; 


{3) an address in California that, based on my 
xesearch using various databases including 
appears to be the home address of the 
parents of ADRIAN LAMO, the defendant, and is the 
same address as the billing address for cellular 
telephone number (415) 505-HACK; 


(4) other addresses on the same street as the above 
address; 


(5) names of various reputed hackers; 
{6) executives of America On-Line (“AOL”); and 
(7) various individuals believed to be associated ‘with 
ADRIAN LAMO, the defendant, in the hacking 
community. . 
{b) on February 26, 2002 (the same date that the author of 
the Article first notified the New York Times that its network 


had been compromised by ADRIAN LAMO, the defendant), in a four 
minute period queries were made in the LexisNexis NEWS library’? 


ae. The LexisNexis NEWS library contains stories from 
newspapers, magazines, wire services, transcripts and 


SB: os 
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(1) “NEW YORK TIMES HACKER’ ; 
(2) “HACKER AND DATE GEQ 02/26/2002";* and 
(3) “ADRIAN LAMO.” 


(c) LexisNexis searches using the unauthorized accounts 
were performed as late as March 20, 2002. 


13. In the course of my investigation I have read 
various articles regarding the New York Times hack, including the 
following: 


(a) An article published on February 26, 2002 on the 
website SecurityFocus.com reported that ADRIAN LAMO, the 
defendant, admitted having accessed the New York Times internal 
network through a proxy server and viewing, among other things, a 
database of employees’ names and Social Security numbers. 
According to the article, LAMO is reported to have stated that 
with respect to the New York Times intrusion, “The very first 
server I looked at was rumming an open proxy.” LAMO continued: 
“The server practically approached me.” In explaining how he 
went about obtaining access .to the New York Times intranet, LAMO 
is reported to have stated that “{t]he proxy was on a different 
network, dealing with the management of subscription information, 
but it was trusted by their internal network.” Regarding the 
employee database that LAMO accessed from within the New York 
Times Intranet, LAMO stated that “[f]lrom what I have been able to 
tell, it was a backup database being used for research.” 


(b} An article published on February 26, 2002 in Newsbytes 
{a Washington Post web site) reported that ADRIAN LAMO, the 
defendant, acknowledged responsibility for the computer intrusion 
of the New York Times, and that Newsbytes had reviewed screen 
captures that depicted the New York Times’ “Everyone, Everywhere” 
newsroom contact database. 


(ec) An article published on February 27, 2002 by website 
Computerworld.com reported that ADRIAN LAMO, the defendant, 


acknowledged responsibility for the computer intrusion of the New 
York Times and that with respect to adding a record under the 


newsletters. 


a This query called for a search for all news articles 
dated February 2, 2002 that included the term “hacker.” 


-9- 


FBI(19-cv-1495)-235 


e ® 


name “Adrian Lamo” in a New York Times database, LAMO stated: “It 
was more of a whim than anything else.” LAMO added that “filt 
just came naturally to me while I was there.” 


{d) An article published on February 27, 2002 by MSNBC.com 
reported that ADRIAN LAMO, the defendant, had provided MSNBC.com 
with screen captures that showed what appeared to be databases 
from the NYT Intranet. 


(e) An article published on February 27, 2002 by the 
Associated Press reported that ADRIAN LAMO, the defendant, had 
acknowledged responsibility for the New York Times hack, and that 
LAMO had stated that he had first obtained access to the NYT 
Intranet ten days before notifying the New York Times, 


Other Computer Intrusions By ADRIAN LAMO, The Defendant 


14. During the course of my investigation of the New 
York Times hack, I have searched public information available on- 
line for further information regarding ADRIAN LAMO, the 
defendant, including further information about other computer 
intrusions for which LAMO has acknowledged responsibility in 
interviews with members of the press. As a result of my 
research, I have obtained and reviewed articles and videos from 
various on-line and print publications in which LAMO was 


interviewed by the authors and claimed responsibility for various 


computer intrusions and related activities. I have also spoken 
and corresponded with representatives of the companies that were 
hacked. In the case of each computer intrusion identified below, 
LAMO has (a) admitted to a member of the press his responsibility 
for the intrusion, as reported in a published article or video, 
{b) described his methods of intrusion and compromise, and (¢) in 
some instances, also personally admitted his responsibility to 
representatives of the victim company and provided corroboration 
that he was in fact the intruder: 


(a) Excite@Home - In or about May 2001, ADRIAN LAMO, the 
defendant, gained unauthorized access to Excite@home’s internal 
computer network. 


{b) Yahoo! - In or about September 2001, ADRIAN LAMO, the 
defendant, gained unauthorized access to Yahoo’s website through 
a proxy server and altered several news stories. 


{c) Microsoft - In or about October 2001, ADRIAN LAMO, the 
defendant, gained unauthorized access into a customer database on 
Microsoft's internal network. 
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(d} MCI WorldCom - In or about November 2001, ADRIAN LAMO, 
the defendant, gained unauthorized access to MCI WorldCom's 
internal computer network through'a MCI WorldCom proxy server. 


(e) SBC Ameritech - In or about December 2001, ADRIAN 
LAMO, the defendant, gained unauthorized access to SBC 
Ameritech’s internal computer network, including access to 
customer information. 


- (f) Cingular - In or about May 2003, ADRIAN LAMO, the 
defendant, gained unauthorized access to the computer system of a 
company that issues insurance to Cingular customers, including 
access to Cingular customer information. 


53 In a April 16, 2003, an article was published in 
a@ newspaper called the San Prancisco Weekly entitled “A Duty To 
Hack,” which quoted ADRIAN LAMO, the defendant, extensively. In 
the article, the reporter states that LAMO is preparing to 
announce his biggest hack to date. According to the reporter, 
LAMO defined his target on the record as a “critical- 
infrastructure-related company” (quotes in original article). 
LAMO goes on to state: “In terms of my personal sense of the 
intrusion and what it affects, I see this as more epic than 
anything I’ve worked on in the past . . . There’s a sense of 
rightness about it. I believe it’s broader in scope, but it also 
has more potential to go terribly south.” 


WHEREFORE, deponent prays that ADRIAN LAMO, the 
defendant, be arrested and i 
be. 


b6 -1 
b7e -1 


Special Agent 
Federal Bureau of Investigation 


orn to before me this 
AUG PY R, Wy of August 2003 


TTED wld of MAGISTRATE JUDGE 


RONALD L. ELLIS 
UNITED STATES CHIEF MAGISTRATE JUDGE 
SOUTHERN DISTRICT OF NEW YORK 


ste ae 
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R12 ew 58) WARRANT FOR ARREST 
- DISTRICT 
Unite States Bistrict Gouri . 
. SOUTHERN DISTRICT OF NEW YORK 
DOCKET NO. MAGISTRATE’S CASE NO. 
UNITED STATES OF AMERICA 3 
; 03 MAG 11540 
NAME AND ADDRESS OF INDIVIDUAL 10 BE ARRESTED 
ADRIAN LAMO 
ADRIAN LAMO 
WARRANT ISSUED ON THE BASIS OF: 0 Order of Court 
D indictment © Information  X Complaint | pistRICT OF ARREST 
‘TO: UNITED STATES MARSHAL OR ANY OTHER AUTHORIZED OFFICER ory 
YOU ARE HEREBY COMMANDED to arrest the above-named person and bring that person before the United States 
District Court to answer to the charge(s) listed below. 
DESCRIPTION OF CHARGES 
Computer Fraud; Trafficking in Access Devices 
IN VIOLATION OF UNITED STATES CODE TITLE SECTION 
18 USC § 1030(a)(5)(A) (ii); 
18 USC § 1029{a)(2) 
| 
BAIL OTHER CONDITIONS OF RELEASE 
ORDERED BY RONALD L ELUS SIGN: (FEDERAL J} 1S AMAGI DATE eis 
UNITED STATES CHIEF MAGISTRATE JUDG Conroe “OL: alg 01 a8 
CLERK OF COURT (BY) DEPUTY CLERK DATE ISSUED 
AUG 0 1 2003 
RETURN 
This warrant was received and executed with the arrest of the above-named person. 
DATE RECEIVED NAME AND TITLE OF ARRESTING OFFICER SIGNATURE OF ARRESTING OFFICER, 
: bo -1 
DATE EXECUTED FBI Special Agent bye -1 


Note: The arresting officer is directed to serve the attached copy of the charge on the defendant at the time this warrant is executed. 
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FD-65 (Rev? 8-22-94) 
4 


Federal Bureau of Investigation 


AIRTEL 


To: Director, FBI 
am ~ att: Criminal Investigative Division Date: 
a Violent Crime/fugitive Unit INSTRUCTIONS - Reverse Side 
NOTE: Priority "A" and "BY Fugitives - With initial 
From: ” SAC, submission, set forth a synopsis of crime on reverse side. 
| Subjects IIL Inquiry 
Na Initial Submission 
- Initial Submission - Parental Kidnaping 
x SPePVETION SSHTRINE™ ., 
ALL INFSRMATIGH CONTAINED D6 -1 Fy supplements 70-65 dated 
REIN IS UNCLAS -1 
iB 
a | Indicate Fugitive Priority 
cl oa 
B 
c 
D {Parental Kidnaping) 
CHECK APPLICABLE WARNINGS 
Caution 
Armed and Dangerous Suicidal Tendencies Known to Abuse Alcohol UKE 
[} Escape Risk [i] Known to Use Narcotics Other 
fame wa 7 WAH] Sex SEX | Race RAC 
Apeian Lamo Mm WwW ie 
Place of Birth POB| Birth Date ‘DOB [ beteor DoE | Height HaT | Weight WaT 
Emancipation iy 
oa-3o- Sry ere S'6*-T 1SQ, | — 
— ; 
Eye Color EYE Eel spor BRN HAL Ho. FBI] Skin Tone SKE 
HEC Gace) T 
Scars, Marks, Tattoos, and Other Characteristics suT 
NCIC Fingerprint Classification FPC| Other Identifying Number unu] Social Security # 4-200" 
O42 ~ OF 4 - CFO 
Operator's License Number aun Operator's License State ous| Year Expires : oLy 


offense charged FRAv» Teatfe 


Camp Tee 


OFF 
ww Access Dences a 


U.S. Code, Title and Section 


1S OSE 19389 aSYA\ie) 


1¥ OSe 1039 C@)C2 


Kiar 
5 


+ 
_ pow! F.0. File# 
warrant Issued By Soctherw Disterl oF NY on a/ ‘ if OF 
ABBA -poy~ 
Miscellaneous Including Bond Recommended caIS) 
LICENSE PLATE AND VEHICLE INFORMATION 

License Plate Number LIC! State LIS | Year Expires LIY | License Plate Type uit 
Vehicle Identification # VIN} Year ¥YR| Make VMA | Model wMO | Style  vVST{ Color vco 


Alvases: 


ditional Identifiers 
Ost Know Apptess 2 1254 Market Sy / F, 


4 


3 
b? 
BY4Ioer 


Seu Fraaneisan , 


NCIC # 


2 + FRIHQ € 1 - VC/FU) 
1+ Savannah ITC 


FBI(9-cv-1495)-239 i 


PRIORITY "A" and "B" Fugitives - Synopsis of Crime. 


4. 
16. 


16. 
1, 


18. 


19, 


20. 


21, 


22, 


23, 


L INFORMATISN CONTAINED b6 -1 
BEIM IS UHL, 


INSTRUCTIONS 


Caution, (MKE) -. Check applicable caution’ type block(s} indicated. The caution statement must also appear in 
Miscellaneous block, e.g., "armed and dangerous". 

Name (NAM) - Place name in this block. Aliases are not to be entered in this block but are to be placed in Aliases 
block. 

Sex (SEX) - Sex will be designated by one letter, M (male) or F {femsle). 

Race (RAC) ~ Race will be described by one letter, A (Asian or Pacific Islander), I (American Indian or Alaskan Native), 
B (Black), W (White), U (Unknown). 

Place of Birth (POB) - Indicate city and state or, if foreign bora, eity and country. Where multiple birthplaces are 
reported, list verified birthplace or that which appeara most logical in this block. 

Birth Date (DOB) - Enter as month, day and year. Where multiple birth dates are reported, enter verified birth date or 
that which appears most logical in this block. Place other dates of birth in Additional Identifiers block. 

Date of Emancipation (DOE) ~ Must be filled in if individual is a juvenile. Otherwise leave blank. 

Height (HG'L) - Express in feet and inches, e.g., 6'0". Round off fractions to nearest inch. 

Weight (WGT) - Express in pounds. Omit fractions. 

Bye Color, (EYE) - Use appropriate three-character symbol. 

Hair Color (HAI) - Use appropriate three-character symbol. 

Skin Tone (SKN) - Use appropriate three-character symbol. 

Scars, Marke, Tattoos, (SMT), and Other Characteristics - Place in this block only appropriate NCIC coding for scars, 
marke, tattoos, birthmarke, deformities, missing body parts and artificial body parts as defined in NCIC Code Manual. 

Hf more than one SMT is to be entered, uee Additional Identifiers block for additional appropriately coded items. Use 
Miscellaneous block to describe all scars, marke, tattoos, end other characteristics, which are not defined in the NCIC 
Gode Manual and to more fully describe SMT's which have been entered in SMT block. For example, an appendectomy scar, 
not being readily visible, would be described in the Miscellaneous block. A tattoo on right arm, shown as TAT R ARM 
in block, might be further described in Miscellaneous block as a rose tattoo on inside of lower right arm. 

NIG Fingerprint Classification (FPC) - Enter NOIC fingerprint classification. 

Other Identifying Number (MNU) - Miscellaneous numbers may be entered with appropriate identifiers (prefixes). For first 
miscellaneous identifying number, use MNU block. When military service number is in fact Social Security Account Number, 
the number should be entered in both MNU and SOC blocks. Additional Identifying numbers are placed in Additional 
Identifiers block. ‘The identifier (prefix) should precede the number and be separated from the number by use of a hyphen. 
Social Security Number (SOC) - Place subject's Social Security Account Number in this block. 

Operator’s License Number - Place subject's operator’s license number in OLN block. Also show licensing state (OLS) and 
year license expires (OLY). 

Warrant Issued By-On-(DOW} - Enter date warrant issued in DOW block. For juvenile offenders, enter the date of violation. 
Miscellaneous (MIS) - Enter additional pertinent information in this block. If caution statement used, besis for 

statement must be set forth as first item in thie block. 

License Plate and Vehicle Information ~ Place information concerning license plate and/or vehicle known to be in the 
possession of subject in appropriate blocks under License Plate and Vehicle Information heading. 

Additional Identifiers - Enter information concerning additional license plates (number, state, year expires, and where 
applicable, type); Social Security Numbers; operator’s Heense number, state and year expires; vehicle information (VIN, 
VYR, VMA, VMO, VST, VCO); MNU’s (see list in item 14 above); visible scars, marke, tattoos, and other characteristics; 
and dates of birth. Clearly identify what data is being set forth; eg., Social Security yf 428-56-8294; Michigan 

operator's license 234567, expires 1999; DOB's 4/5/82, 5/3/32; etc. 

By making an III inquiry, the entering agency may become knowledgeable of additional DOBs, AKAe, and other 

significant information which may aid im the location and/or apprehension of wanted persons. 

Changes and deletions should be so indicated in the appropriate blocks. 


. 


KFED WTST . 

/ORI/.* __ « NAM/LANO, ADRIAN 
- SEX/H. RAC/U, DOR/DSMS1984 
Ina/e.Mis/saL DTS 


N 1628-1828 28/81/23 ROSQ# KFBD 34987 
NYSP WTST KFBD 1825 
NYFBINY@S 


NG RECORD - NYSPIN WANTED PERSONS FILE 


NAM/LAMO, ADRIAN 
". SEX/M. RAC/U. DOB/REQE81 


N 1828-1828 Bo/m1/2S ROSE KFBD 34988 
NYSP FARO KFRD i829 


NYFBINYS3 - 
NO RECORD - NYSPIN PAROLE FILE 
NAN/LANO, ADRIAN 


«SEX/M, RAC/U. DOB/BEeea1L 


N 1828-1828 @8/d1/03 ROSGE KFBD 24989 
NCIC WIST KFBD i185 
NYFBINY@S 


MKE/WANTED PERSON 


ATISH 22) 
ASST 
a EY 


RDSGH 24978069 FART @@i OF @ai 


RDSGH 24978385 PART Bi OF Bi 


RDSOH 24978166 PART Bai OF Oi 


FULL EXTRADITION UNLESS OTHERWISE NOTED IN THE MIS FIELD 


ORI/CABZ40S56 NAM. 

HGT/SW8 WGT/175 EYE/BR@ HAI/BLK FRE 
OFF/PAROLE YISLATION - SEE MIS 
DOW/2NesbES OCA/TI79S2 


SEX/M_RAG/W POB/TX DORA 


SMT/SC HEAD 


MIS/NZEX Q@UTSIDE CA COMMIT FOR RAB END REG 3 LNGREAS 
ORI IS PAR AND COMM SERV DIV REG 1 TERM & SACRAMENTO 516 445-6713 


AKA. 

AKA, 

AKA, 

SMT/SC L EYE: 

SMT/TAT L WRS 

SMT/TAT R SHLD 

SMT/TAT SHLD ‘ 
NIC/W394487397 DTE/EU820714 BE48 EDT 


IMMED CONFIRM WARRANT AND EXTRADITION WITH ORI 


*¥e*x*HARNING - THE FOLLOWING 18 AN NCIC PROTECTIGN ORDER RECORD. 


SEARCH, DETAIN, OR ARREST BASED SOLELY QN THIS RECORD. CONTACT ENTERING 
AGENCY TO CONFIRM STATUS AND TERMS. GF PROTECTION GRDERS#ee+ 


DO NOT 


MKE/WANTED PERSON 

ORI /GAvE70019 NAM[_ SBE /M RAC/W POB/MM a 

HGT/S08 WET/19 EYE/BRG HAI/BLK. FBI 

OFF/PROB YIGLATION - SEE MIS 

00C/4899 DOW/200en618 OCA/SE2-n6950 : 
HIS/EREB VIGL/OBSTRUCTION BA @NLY EXTRAD b6 -5 


ORI eer Bae 770 822-3110 b7c -5 
AKA, ‘ 
NIC/WSTSR6 1895 DTE/EQREO7Z0 1749 EDT 


IMMED CONFIRM WARRANT AND EXTRADITION WITH ORI 


MKE/WANTED PERSON . 

FULL EXTRADITION UNLESS OTHERWISE NOTED IN THE MIS FIELD 
ORI/CARLOMAS2 ‘NAM SEX/M RAC/W DAB/ 
HST/S87 WGT/ié@ EYE/ER@ HAI/BLE 

OFF /BURGLARY 

DOW/2a00N712 OCA/991624786 

MIS/NWEX QUTSIDE CA DAT 4zi6 

ORT IS LOS ANGELES CO SOLOS ANGELES 562 465-7838 
NIC/Wi64407528 DTE/S@038682 BEIM EDT 

IMMED CONFIRM WARRANT AND EXTRADITION WITH ORI 


KFBD HINO DCIS 
16957 "FILE 15 TYPE 1 NAME SEARCH TO DCJS (AND NCIC) PUR/C & F 


»OPERATOR/ » LOG/KFBD, CONF TDENTIAL, LOB/N 

«PUR/C, REASON/CRI. ORI/NYFBINY2S. CASE#/TEBBANYNEW 

- NAM/LAMO, ADRIAN .SEX/M, RAC/U. DOB/@2201 
SKIN TONE/#.HGT/* .SDD/% <FBI/* 2 MIN 
-ALIASH /# 

»ALIASHE/x 

+ ALIASHS /x 

.ALIASHS /x 

~ ALIASHE/# S 
-REQUESTOR'S Name. sa eC = 
. COMMENTS /288QNYNEW COMPUTER INSTRUSION o 


N 1869-1829 @8/8i/23 ROSGH KFBD 34990 ROSOH 24980364 FART BOi OF Bai 
NYSP FTST KFBD 1832 

NYFBINYQ3 

NO RECORD - NYSPIN WANTED PERSONS FILE 

NAM/LOMO, ADRIAN 

-DOB/BE02Bi  : SEX/M. RAC/W 


FBI(19-cv-1495)-242 


HGT/Sa8 WET/19@ EYE/BRA HAI/RED SHT/TAT ARM oy 4 
OLN/LSQG589602088 OLS/MI OLY/20n3 f 

PNO/PPP BRD/N ISD/EO030624 EXP/ERD4ROR4 CTI/MISMMLIST 

PCG/SEE THE MISCELLANEQUS FIELD FOR COMMENTS REGARDING THE TERMS AND CONDITIONS 
FCO/OF THE ORDER. 

QCA/3E76PR ; 

MIS/CONFIRM W/ MSP DISPATCH 213-237-2458 PLEASE SEND FAX 

ORI IS MSP POST 24 RICHMOND 586 727-E00 : 

NIC/HI13848219 DTE/EQU3a627 1619 EDT 


NKE/WANTED PERSON 
NO EXTRADITION 

BRI/SAdAwADE NAML__—=«SEX/M RAC/B POB/GA DOB 

HGT/60@ WGT/i6W EYE/BR@ HOI/BLK FBI SKN/MBR SMT/TAT R HND 
FEC/PHE30910131409121408 SOC, 

OLN/255695261 OLS/GA OLY/EUn2 

OFF/DANSEROUS DRUGS 

DOW/2ReNse1 OCA/YE17e8 

NIS/DRUGS ADDTL.BCA/Y15920, POSS NARIJ/CECAINE W/INTENT Te DISTR BETH/EH 
MIS/ HE WILL QNLY PICK UP IN GE@RGIA — NICKNAME! 

MIS/ ADDITIONAL WARRANT W2SCUE744-FUSS BF COCAINE, POSS YF MARIT WID 
ORI 18 FULTON CO SO ATLANTA 404 720-5126 

DOB. 

DOB. : , 

DOB 

DOB. 

DOB 


SMT/TAT R SHLD 

SMT/TAT ABDAM 

SMT/SC_FACE 

ene FBI(19-cv-1495)-243 
NIC/HB52662800 DTE/ee20630 Lees EDT 

IMMED CONFIRM WARRANT, AND EXTRADITION WITH ORI 


N 1829-1829 88/01/03 ROSG# KFBD 24991 RDS 4980385 PART G@1 OF oat 
NYSP PARG KFBD 1832 . 


NYFBINY@S 
NO RECORD ~ NYSPIN PAROLE FILE 
NAM/LAMO, ADRIAN 


« DOB/@20281. SEX/M. RAC/W 


N 1829-1829 28/21/03 ROSRH KFBD 34992 RDSOH 24980395 FART @21 OF abi 
NCIC PTST KFBD 1832 
| NYFRINYSS 


MKE/WANTED PERSON 

FULL EXTRADITION UNLESS OTHERWISE NOTED IN THE MIS FIELD 
ORI/CAGZ40356 NAM SEX/M RAC/W POB/TX DOB 
HBT/5@8 WGT/175 EVE/BRD HAI/BLK FRI SMT/SC HEAD 
OFF/PAROLE VIQLATION - SEE Mis 

DOW/2@G3V625 OCA/TIT9B2 

MIS/NUEX QUTSIDE CA COMMIT FOR ROB ND REG 2 LNGBEAS 

ORI 1S FAR AND COMM SERV DIV REG 1 TERM ® GACRANENTO 916 445-6713 
AKA 

AKA 

AKA, 

SHT/SC_L EVE 

SHT/TAT L URS 

SHT/TAT R SHLD 

SWT/TAT SHLD 

NIC/HZ94487597 DTE/20020714 2240 EDT 

INMED CONFIRM WARRANT AND EXTRADITION WITH ORY 


#82eeWARNING — THE FOLLOWING 18 AN NCIC PROTECTION ORDER RECORD. DO NOT 
SEARCH, DETAIN, OR ARREST BASED SOLELY ON THIS RECORD. CONTACT ENTERING 
AGENCY TO CONFIRM STATUS AND TERNS OF PROTECTION ORDER###%* 


HKE/TEMPORARY PROT; dE 

ORI /MI5R@2412 a SEX/M RAG/W vos{ 
HGT/S@8 WGT/19@ EYE/BR@ HAI/RED SMT/TAT ARM 

DLN/LS@@589603088 OLS/MI OLY/ea03 

ENO/BEP BRD/N TSD/s00a0624 EXP/2n0406e4 CTI/MISOOLISS 


bé -] 

b7Cc -1 
bo -5 
b7C -5 


FCO/SEE THE MISCELLANEOUS FIELD FOR COMMENTS REGARDING THE TERMS AND CONDITIONS 


PCO/OF THE ORDER. 

OCR/3z76RE 

MIS/CENFIRM W/ NSF DISPATCH 312-227-2450 PLEASE SEND FAX 

ORI 18 MSP POST 24 RICHMOND Sas 727-2202 

NIC/Hi13B48219 DTE/2@OS0627 1619 EDT - 

NKE/WANTED PERSON 

ORT/sAae7ee1e NeM[_____|SEX/M RAC/u BoR/HM DOB{_ | 
HOT/S@8 WGT/19 EYE/BRO HALZALK FRIL_ | 

OFF/PROB VIOLATION - SEE MIS 

O0C/4899 DOW/EROENEe18 OCA/SB2-~N695D 


HIS/FRAB VIGL/@BSTRUCTION + GA BNLY EXTRAD 
ORI IS GWINNETT CO SO LAWRENCEVILLE 778 828-3112 
AKA, 


NIC/WS13861895 DTE/2Wa22728 1749 EDT 
IMMED CONFIRM WARRANT AND EXTRADITION WITH ORT 


MKE/WANTED PERSON 

FULL EXTRADITION UNLESS OTHERWISE NOTED IN THE MIS FIELD 
ORI/CAwI9waS2 NAM[BEX/H- RAC/H DOB. 
HGT/SQ7 WGT/i62 EVE/BR@ HAT/BLK 


OFF/BURGLARY 

DOW/28eaa71Z 0CA/991624786 

MIS/N@EX @UTSIDE CA Das 4B16 

ORI 1S LOS. ANGELES CO SO LOS ANGZgeS Soe 465-7828 

NIC/Wi64407528 DIE/enaaaece BS : e 


IMMED CONFIRM WARRANT AND EXTRADITION WITH ORI 


a . : 
N 1829-1829 @8/21/02 ROSARY KFHD 34993 RDSGH O4980466 PART Whi OF a4 
NYIS HING KFBD 1830 
KFBDI6957 NO SUSPECTS 


o - 


FBI(19-¢v-1495)-244 


ALL INFORMA 
EEREIN 15 U 


OR Oe-14=, 


N 1829-1829 28/01/83. ROSGH KFBD 34994 RDSGH B4980468 PART Bhi Po 
NCIC HING KFBD 
ACK KFBD 
NYFBINY23 ; 
NO IDENTTFIQBLE RECORD IN THE NCIC INTERSTATE IDENTIFICATION INDEX 
{1II) FOR NAM/LANG, ADRIAN, SEX/M, RAC/W. DOB/ 19819202. PUR/C. 5 
END ~ 


KFBD WENT 

16958 FILE & FBI NEW YORK OFFICE NYBFINY@3 AUB 21-23 
TO APB : 

aMKE/# 1GRI/NYPBINY@3:NAM/LAMO, ADRIAN 1SEX/M 
sRAC/Ws DOB/MEVE1958 sSID/* 3CCH/%:SOC/242746804 

+POB/* :HGT/SW6:WGT/150:EVE/HAZ:HAI/BRO:SKN/LGT 

sLCD/ ILCT/F OFF /2609 sEXT/ZROV/*sPFL/# 2 VIC/#E ROR / 
FOCA/KFBD16958 sWTF/1sWAR/* aDKT/® 2DOW/@8A 183 


EMIS/2BBANYNEW/COMPUTER FRD/TRAFFICKING ACCESS DEVICES/FMR ADDR 1254 MARKET ST 

, 16, SAN FRANCISCD, cavssalL___] pts 

aFBI/% SDNU/® TMT /% sFRC/* 

1OLN/* OLS/# sOLY/% a 
aLIC/% @IS/% sLIV/*® aLiT/% D6 -1 

SVIN/* ; ZVYR/* :VMA/% = :VMO/# 1VST/¥ s¥CO/* P ee 


ADDITIONAL COMMENT! 


aut ssaL___—sd ps _ BROWN/ 1841 ; 


N 1842-1842 88/01/23 ROSOH KFBD 34995 RDSGH WSON7426 FART OL OF MeL. 


NYSP KFBD 

ACK SEQ NUM 16958 y 

WENT NAM/LAMO, ADRIAN OCA/KFRD16958 
WPR/7280645 ¢ 


N 1842-1842 28/01/03 ROSH KFBD 34996 RDSOH MSOB7SS2 FART wai OF Bat 
NYIS WENT KFBD 

“ACK 16958 

NYFBINY@S 


DCJS & NCIC ENTRY RESULTS 


ENTERED ON BOTH FILES 
NAM/LANG, ADRIAN OCA/KFBD16958 WRR/7a80615 NIC/W424646227 


KFED WSEN : 

16959 FILE & FRI NEW YORK OFFICE NYBFINY@3 AUS @1~-%3 SUPPLEMENTAL 
To COMPUTER 

REF 


?MKE/N: ORL /NYFBINY2S: NAM/LAMG, ADRIAN xOCA/KFADIG6958 
~800/669169422, 2 


ADDITIONAL COHMENTS — : FBI(19-cv-1495)-245 
a 


aurH ssa. —SCS«iéTS BROWN/1843 b6 -1 


bt. a1, 
N 1843-1843 28/01/03 ROSG# KFBD 34997 RDSH B5QiBe4a PART WAL OF wat 
NYSP KFRD : 
ACK SEG NUM 16959 2 
WEN NAM/LAMO, ADRIAN BCA/KFBDIE69S3 
WPR/738a6 15 8 


ALL INFORMA 
. SEREIN IS UMc: 
ADDED: SAIE G2-14- 
S0C 669169432 


N 1843-1843 98/01/03 ROSO# KFBD 24998 RDSRE BSOiBeIS PART @ai OF avi 
NYIS WSEN KFBD 

ACK 16959 

NYFBINYRS 


DCJS & NCIC SUPPLEMENTAL DATA ENTRY RESULTS 


UPDATED ON BOTH FILES 
NAM/LAMO, ADRIAN OCA/KFBDi6958 
DATA UPDATED: SOC 


YOUR RECORD AS IT NOW APFEARS ON FILE WILL FOLLOW, 


N 1843-1842 e/a /az ROSO# KFBD 24999 ADSM BSQIMSe4 PART O01 OF Bal 


} NYIS WSEN HFBD 


ACK 16959 
NYFBINY@S 4 


DCJS & NCIC SUPPLEMENTAL DATA ENTRY RESULTS 


WANTED PERSON 


DRI/NYFBINYG3 FBI - NYC FIELD GFF 

NAM/LAMO, ADRIAN SEX/M RAC/W DOB/QeBESa - 

SOC/M42746804 HGT/EGG WGT/15@ EYE/HAZ HAI/BRO SKN/LST 

Law CAT/E NCIC OFF/2609 

DCA/KFBDI6958 WARRANT TYPE/ARREST WARRANT 

WARRANT STATUS/ACTIVE 

DOW/2BG1@3 EXT/Z 

MIS/Z8GONYNEW/COMPUTER FRD/TRAFFICKING S DEVICES/FMR ADDR 1254 MA 
RKET ST ,126, SAN FRANCISCO, ope) meme i 


be -1 


WER/7382615 NIC/W404646227 
FR/7S00615 NIC/W4046462% b7C -1 


ADDITIONAL IDENTIFIERS 


$0C/669169432 


THE WANTING AGENCY HAS INDICATED IT WILL EXTRADITE THROUGHOUT 
NEW YORK STATE AND OUTSIDE THE STATE. 


FED WTST FBI(19-cv-1495)-246 
ORI/.* , NAM/LAMB, ADRIAN 

. SEX/M. RAC/U. DOB/S221981.. 

INQ/*,. MIS/* 


res en en a 


N 1844-1844 8/21/03 ROSOH KFBD 25000 RDSOH ASA1iSS2 PART O21 OF agi 
NYSP WTST KFBD 1844 , . 


NYFBINY@S 
NAM/LAMO, ADRIAN 
»SEX/M. RAC/U, DOB/E2028 t bé -l 
CONFIRM RECORD WITH: ORIGINATOR p7c ~1 
MKE/WANTED PERSON 
ORI/NYFBINY@3 ~ US FBI NY FIELD OFFICE B1e-384-1000 
NOH/LAMO, ADRIAN SEX/M RAC/W DOB/@20es8 
SID/. CCH/. SOC/B42746804 POB/. 
HST/S26 WGT/1S0 EYE/HAZ HAI/BRO ~SKN/LET 
LCD/ LET/F OFF/26B9 FRAUD AND ABUSE-COMPUTER 
WST/1 - ACTIVE 
WTP/1 — ARREST WORRANT 
EXT/Z- WITHIN AND GUTSIDE NEW YORK STATE 
RCV/, EIFL/. VIC/. RSE/. 
OCA/KFRDi6958 WAR/. DAT/. DOW/BaRLR3 
NIS/GBGANVNEW/CONPUTER FRD/TRAFFIGKING ACCESS DEVICES/FNR ADDR 1254 MARKET S 
T ,105, SAN FRANCISCO, cavssA[ DTS) 
FBI/. HNU/. SMT/. | EPCS. b6 -1 
y OLN/. OLS/, OLY/. 
LIC. LIS/. LIV. LITA bIc -1 
VIN/. VYR/. UMA/.  UMO/.  VST/. YCO/. 
ARI/. ACA/. DOA/. RES/. 
WER/7280615 
##884ADDI TIONAL SUPPLEMENTAL DATAZSK#* 
——-ste—- 
669169432 
| R 1844-1844 08/01/83 ROSH MFBD 25001 RDSOS ASAiis7e PART eal OF aot 
NYSP PARG KFBD 1844 
NVFBINY@3 . 
NO RECORD ~ NYSPIN PQROLE FILE 
NAM/LAMO, ADRIAN 
. SEX/M, RAC/U, DOB/ 220281 
N 1844-1844 @8/01/03 ROSC KFRD S5@02 RDSRE @SQi1S7S PART Bat OF Bei 
NCIC HTST KEBD 1844 
NYPBINY@S 
MKE/WANTED PERSON 
FULL EXTRADITION UNLESS OTHERWISE NOTED IN THE MIS FIELD . : 
GRI/CARZ42356 NAM SEX/M_RAG/W POB/TX lt] | 
HBT/5@8 WGT/i75 EVE7ERO HAI/BLK FBI MT/SC HEAD ; 
OFF/PAROLE VIOLATION — SEE MIS 
DOW/ERBSEEE5 OCA/TL795E 
MIS/NQEX BUTSIDE CA C2MMIT F@R ROB END REG 3 LNGBEAZ . 
ORI IS PAR AND COMM.SERV DIV REG 1 TERM & SACRAMENTO 916 445-6713 bo -5 
AKA. . bic -5 
AKA _ 
AKA 


SMT/SC L EYE 

SMT/TAT L WRS 

SMT/TAT R SHLD 

SMT/TAT SHLD 

NIC/W394487597 DTE/SR28714 2240 EDT 

IMMED CONFIRM WARRANT AND EXTRADITION WITH ORI 


#4e4<WARNING - THE FOLLOWING IS AN NCIC PROTECTION GRDER RECORD. DO NOT FBI(19-cv-1495)-247 
SEARCH, DETAIN, OR ARREST BASED SOLELY ON THIS RECORD. CONTACT ENTERING 
AGENCY TO CONFIRM STATUS AND TERMS OF PROTECTION GRDERe##+% 


ORI/NYFBINV@3 = FBI - NYC FIELD OFF 

NAM/LAMO, ADRIAN SEX/M RAC/W DOB/M22a81 

SDC/842746804 HET/S@6 WGT/150 EYE/HAZ HAI/BRO SKN/LGT 

LAW CAT/F NCIC OFF/2609 

OCA/KFRDI6958 WARRANT TYPE/ARREST WARRANT 

WARRANT STATUS/ACTIVE 

DOW/@BRiGS EXT/Z 

MIS/ZBBANYNEW/COMPUTER FRD/TRAFFICKING ES/FMR ADDR 1654 MA 7 
RKET ST ,106, SAN FRANCISCO, cvssal Ts bo -1 

b7C -1 
WER/7280615 NIC/W4O4646227 


ADDITIONAL IDENTIFIERS 


800/66916942e 


THE WANTING AGENCY HAS INDICATED IT WILL EXTRADITE THROUGHOUT 
NEW YGRK STATE AND OUTSIDE THE STATE. 


N BO20-003@ 08/06/83 ROSGH KFBD 25521 RDSU# B6S61042 FART Gai OF oat 
NIC WIST KFBD aae7 
NYFBINY@S 


HKE/WANTED PERSON , 


FULL EXTRADITION UNLESS OTHERWISE NOTED IN THE MIS FIELD 
ORI/CABZ40256 NAM SEX/M RAC/W POB/TX DOB 
HST/S08 WBT/175 EVE7ERE HAI/BLK FBI SMT/SC HEAD 


OFF/PAROQLE VIOLATION - SEE MIS 
ROW/20GSGEE5 CCA/TI79S2 : 
MIS/N@EX BUTSIDE CA COMMIT F@R RAB 2ND RES 2 LNGREAZ 


ORI IS POR AND COMM SERV DiV REG 1 TERM & SACRAMENTO 916 445-6712 bo -5 
AKA. b7c -5 
AKA . 
BRA, 


SMT/SC L EYE 

SMT/TAT L WRS 

SMT/TAT R SHLD 

SMT/TAT SHLD 

NIC/W294487597 DIE/E2830714 2248 EDT 

IMMED CONFIRM WARRANT AND EXTRADITION WITH ORI 
FBI(19-cv-1495)-249 
*##2450HRNING - THE FOLLOWING IS AN NCIC PROTECTION ORDER RECORD. DO NOT 


SEARCH, DETAIN, OR ARREST BASED SOLELY ON THIS RECORD. CONTACT ENTERING 3 
AGENCY TO CONFIRM STATUS AND TERMS OF PROTECTION ORDERS**4x 


KFBD WHOD 
27038 FILE @& (FRI NEW YORK OFFICE NYBFINYYS AUG @6—-2s ADDED INFO 
TG COMPUTER 

REF 

WANTED PERSON MODIFICATION 

tMKE/#:ORI /NYFBINYAS 

aNaM/LAMNO, ADRIAN :0CA/KFBDL69S8 

~ DOB/BEEB1981. ‘ 


ADDITIONAL COMMENTS 


i | HEAVEY Rass 


N Q@BE9-OBE5 28/26/23 ROSH KFBD 25518 RDSO# 86256889 FART M1 OF mai 


NYSP KFBD : bé -1 
ACK SEG NUM 17038 pyc -1 
WMOD = NAM/LANO, ADRIAN OCA/KFBBI6958 . 
WER/72826 15 


N B2S9-UGE9 ZA/MO/BZ ROSHH KFRD 35519 RDSOH W6357276 PART BAi OF avi 
NYIS WHOD KFBD 

ACK 17028 

NYFBINYSS 


DOIS &@ NCIC MODIFY RESULTS 


MODIFIED ON BOTH FILES 
NAM/LANO, ADRIAN . OCA/KFBDI6958 
DATA MODIFIED: DOB 


NCIC RELATED WANT 

¥#%# SEXUAL OFFENDER REGISTRY INFORMATION *** 

THE SUBJECT IDENTIFIED IN THE FOLLOWING RECORD WITH NIC/XS7O374045 

18 REGISTERED AS A CONVICTED SEXUAL OFFENDER. DQ NOT SEARCH, DETAIN, OR 
ARREST BASED SOLELY ON THIS RECORD. ADDITIONAL INFORMATION REGARDING 
SUBJECT MAY BE AVAILABLE FROM THE INTERSTATE IDENTIFICATION INDEX. 


MKE/SEXUAL OFFENDER 


ORI/Txia1enoe nan] BEX/M _RAC/W ROB/TX DOBY 
HBT/S@G_NGT/i71 EVE/BRU HAI/ELK FBI SKN/FAR 
CL 


soc 
ORD /2ORS0S0S ERD/NONEXE SXP/N CRR/SEX ASSAULT - 
CON/1999N31@ AOV/19 SOV/F DNA/N b6 
OCA/R6235245 b7Cc -5 
ORI 1S HARRIS CO 80 HOUSTON 713 755-6042 . 

ADDRESS 


COUNTY - 
AKA 
NIC/XS7@S74045 DTE/SQNER9R4 BITZ EDT ; 


484% END CF SEXUAL OFFENDER REGISTRY INFORMATION «xes# 


YOUR RECORD AS IT NOW APPEARS ON FILE WILL FOLLOW. 


N O@29-20e9 WB/E6/OZ ROSR# KFBD SE820 RDSO# GEZ57S95 PART Wl OF Bei 
NYIS WMGD KFBD 

ACK 17832 

NYFBINYGS 


DCIS & NCIC MODIFY RESULTS 4 
FBI(19-cv-1495)-250 


KFBD WTST 
ORI/.% » NAN/LAMO, ADRIAN 
» SEX/M. RAC/U, DOB/GE201981, 
ING/#, MIS/ 


N @O31-@0S1 98/06/23 
NYSP WIST KFBD age 
NYFBINYQ3 

NAM/LAMO, ADRIAN 

» SEX/M. RAC/U, DOB/ORE881 


ROSG# KFBD 355e2 


CONFIRM RECORD WITH ORIGINATOR 


HKE/WANTED PERSON 

ORI/NYFRINY@S ~ US FBI NY FIELD OFFICE 
NAM/LAMO, ADRIAN SEX/M RAC/W DOB/S2a08i1 
SID/. CCH/. SOC/8427468R4 POB/. 


LOD/ 

WET/1 - ACTIVE 
WIP/i - ARREST WARRANT 
EXT/Z- 
RCV/. PFL/. VIC/. 
OCA/KFRDI6958 WAR/. 


LOT/F GFF/2649 FRAUD AND 


RSF/, 


DAT/. DOW/2801B3 


MIS/EBBANYNEW/COMPUTER FRD/T: 
T ,186, SAN FRANCISCO, CA/SS: 


RDSG# 6366977 PART @@1 OF @ai 


212-384-1000 


HGT/S@6 WGT/15B EYE/HAZ HAI/BRO SKN/LGT 


ARUSE~COMPUTER 


WITHIN AND GUTSIDE NEW YORK STATE 


CESS DEVICES/FMR ADDR 1254 MARKET S$ 
DTS 


FBI/. 
OLN/. 
LIC/. 
VIN/. 
ARI/. 


MNU/. 
OLS/. 
LIS/. 
VYR/, 
ACA/. 


SHT/. 
OLY/. 
LIY/. 
UMA/. 
DORs. 


FPC/. 


LiT/. 
VMO/. 
RES/. 


VST/. VCO/. 


b6 
b7C 


-1 
=1 


WER/7380615 


###**ODDI TIONAL SUPPLEMENTAL DATARREx® 


---S00--- 
669169432 


N @Bgi-dasi 08/26/03 ROSGH KFRD SSeS RDSOH 6366999 PART B21 OF aei 
NYSP FARG KFAD B03= 

NYFRINYQS 

NO RECORD - NYSFIN PAROLE FILE 

NaM/LAMO, ADRIAN 


SEX/M. RAC/U. DOB/@ee0a 1 


@ 
e 


N @23i-O23i “WB/2e/BZ ROSRR KFBD 25524 RDSRH BSS47GSN PART Bei OF esi 
NCIC WTST KFAD waae 
NYPBINYS3 


MKE/WANTED PERSON 

FULL EXTRADITION UNLESS OTHERWISE NOTED IN THE MIS FIELD 

ORI/NYFBINY23 NAM/LAM@, ADRIAN SEX/M RAC/W DOB/i9a1e22a 

HST/S26 WST/i5@ EYE/HAZ HAI/BRG SKN/LGT : 

SOC/@42746824 

OFF/FRAUD AND ABUSE, COMPUTER 

DOW/2B020821 OCA/KFBDI6958 

MIS/ESSANYNEW/COMPUTER FRD/TRAFFICKING ACCESS DEVICES/FMR ADDR 1254 MARKET ST 
HIS/,1%6, SAN FRANCISCA, cA/ssAl PTS 

ORI IS FAI NEW YORK £12 384~ia00 

$0C/669169422 

NIC/W404646227 DTE/EWO20881 1837 EDT FBI(19-cv-1495)-252 


b6 
b7C 


aa 
Belk 


#*®% SEXUAL OFFENDER REGISTRY INFORMATION #¥% 
THE SUBJECT IDENTIFIED IN THE FOLLOWING RECORD WITH NIC/X57@374845 
TS REGISTERED AS & CONVICTED SEXUAL OFFENDER. DQ NOT SEARCH, DETAIN, OR 
ARREST BASED SOLELY ON THIS RECORD. ADDITIONAL INFORMATION REGARDING 
SUBJECT MAY BE AVAILABLE FROM THE INTERSTATE IDENTIFICATION INDEX. 


MKE/SEXUAL OFFENDER 
ORI/TXid Bae NAM EX/M RAC/W POB/TX DOR, sd 
HET/SQ6 WGT/171 EVE/BRO HAI/BLK FBI KN/FAR 

socl___] 

ORD/2G0S0305 ERD/NONEXP SXE/N CRR/SEX ASSAULT 

CON/1999231% ADV/19 SOV/F DNA/N Dé 5 

OCA/ 86235245 ae 

ORI 1S HARRIS CD S0 HOUSTON 713 7S5-an4e - 
ADDRESS 


COUNTY — 
AKA! 
NIC/XS70374045 DIE/SMOAOIE4 WIGS EDT 


¥eeee END GF SEXUAL OFFENDER REGISTRY INFORMATION «242% 


WARNING SUBJECT OF NIC/NZEM094395 IS A PREVIOUSLY DEPORTED CRIMINAL ALIEN. 
FEDERAL LAW 6 USC 12520 PROVIDES, IF PERMITTED BY STATE AND LOCAL LAW, A 
STATE OR LOCAL LAW ENFORCEMENT OFFICIAL MAY ARREST AND DETAIN THE SUBJECT BUT 
ONLY AFTER THE ALIEN*S STATUS IS CONFIRMED WITH INS. IF PERMITTED WITHIN YOUR 
JURISDICTION, GR IF SUBJECT HAS BEEN ARRESTED OR DETAINED ON OTHER 

GROUNDS, CONTACT (877) 999-S3a7z TO CONFIRM HIT. IF SUBJECT IS BEING RELEASED, 
OBTAIN ADDRESS, VEHICLE LICENSE, AND ANY OTHER DOCUMENT INFORMATION 

AND FORWARD TO INS VIA NLETS AT GRI VTINSigaa. 


MKE/DEFORTED FELON 


GRI/VTING1a@a NAM SEX/M ROC/W POR/MM DOB. 
HET/S@% WGT/i3@ EYE/BR@ HAI/BLK FRI SMT /MISS L FGR bp6 -5 
FPC/PIGOPIPMIGDIXXXXPIIS MNU/AR-AG77182423 pyc -5 


OFF/SUBJECT is A DERORTED CRIMINAL/AGGRAVATED FELON 
OCA/A7718e46E3 

GRI Is US TsMEGRATION AND NATURALIZATION SERVICE, LAW ENFORCEMENT SUPPORT CENTER 877 999-537 
AKA 

AKA. 

SMT/TAT UL ARM 

SMT/TAT UR ARM 

NIC/NSEGN94395 DTE/eoeciect 1147 EDT 

} #¥xxe =6THIS RECORD MAY ONLY BE USED BY CRIMINAL JUSTICE AGENCIES FOR 

CRIMINAL JUSTICE PURPOSES. 

weeee END OF DEPORTED FELON FILE RESPONSE. #2%%% 


#*28WARNING - THE FOLLOWING IS AN NCIC PROTECTION ORDER RECORD. DO NOT 
SEARCH, DETAIN, OR ARREST BASED SOLELY ON THIS RECORD. CONTACT ENTERING 
AGENCY TO CONFIRM STATUS AND TERMS OF PROTECTION ORDERSt#ee 


*##%THE SUBJECT OF THIS RECORD IS PROHIBITED FROM RECEIVING OR POSSESSING 
A FIREARM UNDER FEDERAL LAW (TITLE 1B U.S.C., SECTION 922) #ee% 


MKE/PROTECTION ORDER 
oRi/enesaeeri nem{_ sd SEX/M Rac/B DoB{__—s«ds 
HGT/6B1_ WGT/18% EYE/BRO HAI/BLK 


soc] 
FNO/DUGZ-BOS1 BRD/Y ISD/E00201Z1 EXP/AMOHRISL CTI/OHRABDLAD 

PPA, PPB 

PCO/THE SUBJECT 18 RE OM ASSAULTING, THREATENING, ABUSING, HARASSING, - og 

PCO/FOLLOWING, INTERFERING, OR STALKING THE PROTECTED PERSON AND/GR THE CHILD be —5 

PCO/OF THE PROTECTED PERSON. b7c -5 
OCA/DVDZ-DOS% 

WIS/CODES @1 @4 25 

ORI 1S LUCAS CO 80 TOLEDO 419 212-4941 

(2:2) 

PCO/THE SUBJECT IS REQUIRED TO STAY AWAY FROM THE RESIDENCE, PROPERTY, SCHOOL, 

RCO/OR PLACE OF EMELOVMENT OF THE PROTECTED PERSON OR OTHER FAMILY OR HOUSEHCLD 

PCO/MEMBER, 

PCO/THE SUBJECT IS RESTRAINED FROM MAKING ANY COMMUNICATION WITH THE PROTECTED 

PCO/PERSON INCLUDING BUT NOT LIMITED TO, PERSONAL, WRITTEN, OR TELEPHONE 

PCO/CONTACT, OR THEIR EMPLOYERS, EMPLOYEES OR FELLOW WORKERS, OR CTHERS WITH 

PCO/WHOM THE COMMUNICATION WOULD BE LIKELY TO CAUSE ANNOYANCE OR ALARM THE 

POO/VICTIM. 

NIC/HE934323448 DTE/2QO20208 1721 EST FBI(19-cv-1495)-253 


ey oe 
me, gyprot 


G471G2 PART GGL OF Gel ee 


FOGG 


2 WITH ORTGTMATIR 


dM 
US FRE MY FIEL OFF 


BKNALGT : 
UD INI ISESCHOMELI TIER . 


MTZ. DOW/ANE 

TER FRO/TRAFFIGKING ACCESS DEVICES/FMR ADDR LAt4 MARKET 8 

isco, caveats 
FPO, 


LIZ 0 
ViO/. VSE/, VOU. 
BEB a 


ITAL. DET Arr 


S47 RART 2 oF 


FBI(19-cv-1495)-254 


Get 


Se BEMA7S. 


M LIMES OT! 
Ne ALS, ly 


FIR ABIDE 


RYDE RK ll 
DMA 5 


HUST EC 


NE. aes 


JWING 1S AM NCIC PROT 
SOLELY ON -TH 
PROTEC 


THIS RECORD (S PROHLELTED FIRGH 
DERAL LAW (TITLE Diy Unie Gy GE 


exe Recs vol | 


TION ORGER 


RG HAL/BLIK 


aie) 


FBI(19-cv-1495)-254 


‘ 


“MERD UCAN 


1aut6s FILE'S FRI NEW YORK OFFICE NYRFINY2S SEP 19-83 CANCEL 
TO AFB 


- [ 
WANTED PERSON CANCELLATION 


iKE/#: ORT /NYPBINYZ3 :NAM/LAMO, ADRIAN 
FOCA/KFBDI6958 =RSN/Z. 


ADDITIONAL COMMENTS 


b6é -1 
b7c -] 


autH[ dH DTS | 


N 1242-12342 09/19/83 ROSGH KFAD S@5i5 RDSOH BE1BS623 PART WAL OF wal 
NYSE KFBD 

ACK SEG NUM 16063 

WCAN — NAM/LAMO, ADRIAN QCA/KFBDI6958 

WER/ 7380615 : 


N 1248-1242 09/19/03 ROSQH KFBD 50516 RDSOH BEi8E741 PART Wi OF aai 
NYIS WCAN KFRD 

ACK isteg 

NYFBINY@S 


DCJS & NCIC CANCEL RESULTS 


CANCELLED FROM BOTH FILES 
NAM/LAMG, ADRIAN OCA/KFRDIG958 WPR/7280615 


FBI(19-cv-1495)-256 


* sare n2-14-20 co BRS DESRY. / Tr gern 


FAD WTST ‘ - 

ORI/. x « NAM/LANO, ADRIAN be -1 ban ut 
+ SEX/M. RAC/U, DO Sai. bic -1 

ING/#, MIS DT-2 


N 1248-1342 09/19/03 ROSH KFRD 50517 RDSO# B21B4587 PART Gai OF wai 
NYSE WTST KFED 1343 
NYFBINYOS . 


NO RECORD - NYSPIN WANTED PERSONS FILE 
NOH/LANG, ADRIAN 
+ SEX/M, RAC/U. DOB/MEEN81 


N 1348-1342 09/19/03 ROSO# KFBD 50518 RDSRe @ELB4595 PART BAL OF gat 
NYSP PARG KFED 1343 


NYFBINY@3 
NO RECGRD - NYSFIN POROLE FILE 
NAM/LAMO, ADRIAN 


» SEX/M, RAC/U, DOB/B220a1 


N 1242-124% 29/19/03. ROSH KFBD 50519 RDS BE184668 PART Wai OF mai 
NCIC WIST KFBD 1243 
NYFBINY@S 


#%* SEXUAL OFFENDER REGISTRY INFORMATION ##x 

THE SUBJECT IDENTIFIED IN THE FOLLOWING RECORD WITH NIC/AS 70374045 

1S REGISTERED AS A CONVICTED SEXUAL OFFENDER. D0 NOT SEARCH, DETAIN, OR 
ARREST BASED SOLELY ON THIS RECORD. ADDITIONAL INFORMATION REGARDING 
SURJECT MAY BE AVAILABLE FROM THE INTERSTATE IDENTIFICATION INDEX. 


| MKE/SEXUAL OFFENDER 


~ORI/TX1MiaRae NAD W BOR/TX DORs 
HBT/5a6 1 EYE/BRO HAI/BLK FRI SKN/FAR 
0c 


ORD/E@ASBS0S ERD/NONEXP SXP/N CRR/SEX ASSAULT bé -5 

}CON/1999%312 AGV/19 SDV/F DNA/N b7c -5 

OCA/86235245, . . 

ORI IS HARRIS CO Si 7i3 755-6262 

ADDRESS 

Prep = FBI(19-cv-1495)-257 
NIC. E/ESG20924 BOSS EDT 


perteeeeeennsndemiiiemme 7 


‘eee END OF SEXUAL OFFENDER REGISTRY INFORMATION xaee# 


WARNING REGARDING FOLLOWING RECORD - SUBJECT OF NIC/NZ2@294395 18 A 
PREVIOUSLY DEPORTED FELON, CONTACT LESC AT (877) 999-5272 FOR IMMEDIATE 
HET CONFIRMATION AND AVAILABILITY OF BUREAU OF IMMIGRATION AND 

CUSTOMS ENFORCEMENT DETAINER. 

MKE/INMIGRATION VIOLATION — DECORTED FELON 

ORI/VTINSLGOD NAM SEX/M RAC/W FoByMM DOB ———«di 
HGT/S@@ WGT/130 EYE/ERO HAI/ELK FBI SMT/MISS L FER 
FRC/PIGSPIPMLODIXXXXPLIS MNU/AR-AGT LOSSES 

OFF/SUBJECT 18 @ DEPORTED CRIMINAL/AGGRAVATED FELON 

OCA/AT718B4R3 

ORI IS BUREAU OF IMMIGRATION AND CUSTOMS ENFORCEMENT, LAW ENFORCEMENT SUPPORT CENTER 877 999- 


a 


AKA 

AKA. 

SMT/TAT UL ARM 

SMT/TAT UR ARM 

NIC/NSEQN94295 DTE/EQOELBE1 1147 EDT 

wees THIS RECORD MAY ONLY BE USED BY CRIMINAL JUSTICE AGENCIES FOR 
CRIMINAL JUSTICE PURPOSES. 

eeexe END OF IMMIGRATION VIOLATOR FILE RESPONSE, #exe% 


#eee4HARNING - THE FOLLOWING IS AN NCIC PROTECTION ORDER RECORD. DO NOT b7C -5 
SEARCH, DETAIN, OR ARREST BASED SOLELY ON THIS RECORD. CONTACT ENTERING 
AGENCY TO CONFIRM STATUS AND TERMS OF PROTECTION ORDERS#exx 


#e8aTHE SUBJECT OF THIS RECORD IS PROHIBITED FROM RECEIVING GR POSSESSING 
A FIREARM UNDER FEDERAL LAW (TITLE 18, U.S.C., SECTION 922) #xx% 


MKE/PROTECTION OR 

ORT /aHeseoat Nem ex racyp popl—id 

HBT/6Q4 WGT/15@ EVE7BRE AAT/ELK 

sot 

FNO/DVGS-OUSi BRD/Y ISb/E0020121 EXP/E0US@131 CTI /aHOABA1aD 

i, a 

FCO/THE SUBJECT IS RESTRAINED FROM ASSAULTING, THREATENING, ARUSING, HARASSING, 
PCO/FOLLOWINS, INTERFERING, GR STALKING THE PROTECTED PERSON AND/OR THE CHILD 
BCO/OF THE PROTECTED PERSON. 

acA/Dvas-2051 

HIS/CADES @1 84 as 

ORI 9 TOLEDO 419 212-4941 

BRN PR 

PCO/THE SUBJECT IS REQUIRED TO STAY AWAY FROM THE RESIDENCE, PROPERTY, SCHOOL, 
PCO/OR PLACE OF EMPLOYMENT OF THE PROTECTED PERSGN OR OTHER FAMILY OR HOUSEHOLD 
PCD/HEMBER. 

POO/THE SUBJECT 18 RESTRAINED FROM MAKING ANY CONMUNICATION WITH THE PROTECTED 
BCO/FERSON INCLUDING BUT NOT LINITED TO, FERSONAL, WRITTEN, OR TELEPHONE 
PCO/CONTACT, OR THEIR EMPLOYERS, EMPLOYEES OR FELLOW WORKERS, OR OTHERS WITH 
PCO/WHON THE COMMUNICATION WOULD BE LIKELY TO CAUSE ANNOYANCE OR ALARM THE 
PCOMVICTIM, 

NIC/HE934224e6 DTE/2qes0ENs 1721 EST 


2 


7 


FBI(19-cv-1495)-258 


(Rev, 01-31-2003) 


FEDERAL BUREAU OF INVESTIGATION 


Precedence: PRIORITY Date: 08/29/2003 


to: Mew York Keen: | 


From: Richmond 
Squad 3 


approved By: [7] b3 -2 


be -1 
Drafted By: b7c -1 


xs 
Case ID #: or bTE -3 
eying 


Title: ADRIAN LAMO 
NEW YORK TIMES - VICTIM 
COMPUTER INTRUSION 


Synopsis: Lead covered - negative response. 


Details: After canvassing available sources, no additional leads 
regarding the whereabouts of Adrian Lamo were identified. 


FBI(19-cv-1495)-259 


To: New York From: Richmond 
Re: 08/29/2003 


“LEAD (s) : 
Set Lead 1: (Action) 
NEW YORK 
AT NEW YORK, NY 


Read and clear. 


+ 


FBI(19-cv-1495)-260 


Fy 


(Rev. 01-31-2003) 
FEDERAL BUREAU OF INVESTIGATION 
Precedence: ROUTINE Date: 07/22/2003 
To: New York b6 -1 
From: New York DA SE 
Squad DT-5 
Contact: SA 
Approved By: 
f a 
Drafted By: [7 sl 10. 1 
biG 1 
Case ID # (Pending) bIE -3 


York Times-Victim; 
Computer Intrusion; 
OO :NY 


Synopsis: Request permission for three(3) Agents to attend DEF 
CON 11 in Las Vegas, NV from August 1-3, 2003. 


Details: DEF CON is an annual computer underground party for 
hackers held in Las Vegas, Nevada. Over the years it has grown 
in size and attracted people from all over the world. ADRIAN 
LAMO (Subject) has attended the conference for the past three (3 
years. 


ADRIAN LAMO is a twenty two (22) year old male who 
commits unauthorized computer intrusions into major corporations 
LAMO is labeled in the media as the "homeless hacker". He 
considers himself a "white hat hacker". Investigation by the New 
York Office has revealed that LAMO is a "black hat hacker“, an 
individual who breaks into a computer system with the purpose of 


) 


inflicting damage or stealing data. Each time LAMO- hacks a major 


corporation he alerts friends in the media first and has them 
contact the victim for comment. 


In September 2001, LAMO hacked YAHOO! and rewrote the 
text of a YAHOO! News article. LAMO gained access through the 
portal's web-based production tools and modified a news story 
about DMITRY SKLYAROV, a Russian computer programmer facing 
federal criminal charges. LAMO used a free internet connection 


at KINKOS to commit the hack, YAHOO! was informed of the breach, 
. after being contacted b: who 
was contacted by LAMO. was convicted in 1990's by the 


FBI for committing unauthorized computer intrusions. 


“eb 6 
b7C 
b3 
b7E 


35) 
Bae! 

-2 
=3 


ee Pees oe fel 


b3 -2 @ 
, lO: New York From: New York bIE -3 
od 


In October 2001, LAMO contacted the reporter,[ sd 
to inform him that he had gained 

unauthorized access into a MICROSOFT customer service database. 
LAMO had gained access to MICROSOFT's database is September 2001 
but choose not to disclose his access until October 2001. LAMO 
utilized a vulnerability in MICROSOFT's network that allowed an Be: 25 
unpublished Internet Protocol (IP) address to be entered into a = 
web browser. The IP address provided access to records of people bic -5 
who had bought products and services from MICROSOFT. ae 
contacted MICROSOFT to ask them for a comment for the story he 
was writing about the hack. This was the first instance, 
MIC i i T confirmed the hack 
and described the 
incident as "an error that led to a breach of privacy, against 
our privacy policy". 


In December 2001, LAMO contacted the reporter, Ld 
to inform him that he had gained 

unauthorized access into MCI WORLDCOM's internal network. LAMO 
gained access to WORLDCOM's internal network in October 2001 but 
choose not to disclose his access until December 2001. LAMO 
provided internal screen captures to WORLDCOM to prove he was the b6 -5 
hacker. The screen captures from WORLDCOM's internal network ee 
state, "Not to be reproduced in any manner or disclosed to b7C —5S 
unauthorized individuals". LAMO gained access to WORLDCOM's 
internal network using a free internet connection at KINKOS. 
LAMO exploited a vulnerability in a WORLDCOM proxy server to gain 
unauthorized access to their network. After committing the hack 
and reporting it tol sd LAM. commented "The downside is, I'm 
running out of major US Corporations". Also, one of LAMO's 
prized possessions is a screen capture of WORLDCOM's stock price 
falling after he announced he had hacked the company. 


2002, LAMO contacted the reporter,[ sd 
to inform him that he had gained 


unauthorized access into SBC COMMUNICATIONS. LAMO gained access 

to SBC COMMUNICATIONS network in December 2001 but choose not to . 
disclose his access until February 2002. LAMO utilized an bo -5 
exploit to gain access to SBC's internal network. LAMO used’a DLC =5 
free internet connection at KINKO's to perform the hack. LAMO 

gained access to usernames, passwords, telephone numbers, 

addresses and other sensitive customer information. 


In February 2002, LAMO discovered several misconfigured 
proxy servers acting as doorways between the public Internet and 
the NEW YORK TIMES private intranet. LAMO contacted of 

[to inform him that he had gained unauthorized 
access into The NEW YORK TIMES intranet. LAMO utilized the proxy 
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To: New New York b3 
Re: 07/22/2003 b7E - 


servers to gain access to the NEW YORK TIMES network. Once on 
’ the network, LAMO cracked a password for a userid with supervisor 

vights. Utilizing this userid he was able to broaden his access 
as well as perform certain functions within the network. LAMO 
created four (4) Lexis/Nexus accounts off of the NEW YORK TIMES 
intranet and utilized these accounts for himself and/or friends 
to run over 3,000 searches of individuals, address and/or court 
documents. 


LAMO has committed other computer intrusions into 
several other corporations such as AOL and EXCITE@HOME. Each 
time LAMO commits a computer intrusion on a high profile 
organization he reports the vunerability and intrusion to the 
media causing a distrust of the company's clients. The above 
mentioned corporations have lost significant money and trust of 
their clients. 


Writer will be completing the complaint and search 
warrant on LAMO Monday, July 28, 2003. Due to LAMO's vagrant 
lifestyle, numerous attempts to locate him have been negative. 
The NYO has learned that LAMO will be attending DEF CON in Las 
Vegas, NV from August 1-3, 2003. Writer requests permission for 
three (3) DT-5 Agents to travel to DEF CON to execute the arrest 
of LAMO and the search of his laptop. Writer will coordinate the 
arrest and search with the Las Vegas Office. 


had 
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FEDERAL BUREAU OF INVESTIGATION RiBEs 
Precedence: ROUTINE Date: 09/03/2003 
To: New York Attn: Squad _SO-6 
SSA 
San Francisco SA _—aee| 
From: New York b3 -2 


Squad DT-5 HELe1 
Cont: : SA 
Drafted by: ["_}it 


Title: ADRIAN LAMO 
New York Times-Victim; 
Computer Intrusion; 
00: NY 


Synopsis: Request ,assistance in locating and apprehending ADRIAN 
LAMO. 


Details: A AMO“is a twenty two (22) year old male who 
commits unautférized computer intrusions into major corporations. 
LAMO is labeled in the media as the “homeless hacker". He 
considers himself a "white hat hacker". Investigation by the New 
York Office has revealed that LAMO is a "black hat hacker", an 
individual who breaks into a computer system with the purpose of 
inflicting damage or stealing data. Each time LAMO hacks a major 
corporation he alerts friends in the media first and has them 
contact the victim for comment. 


In September 2001, LAMO hacked YAHOO! and rewrote the 
text of a YAHOO! News article. LAMO gained access through the 
portal's web-based production tools and modified a news story 
about DMITRY SKLYAROV, a Russian computer programmer facing 
federal criminal charges. LAMO used a free internet connection 
at KINKOS to commit the hack. YAHOO! was informed of the breach 
after being contacted b who b6 -5 
was contacted by LAMO. was convicted 1990's by the pyc -5| 
FBI for committing unauthorized computer intrusions. 


per 2001, LAMO contacted the reporter, | a | 
to’ inform him that he had gained 
unauthorized-access into a MICROSOFT customer service database. 
a ex 


wee 
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To: New York From: New York 


ne: [ee] 09/03/2003, 7B 3 


LAMO had gained access to MICROSOFT's database is September 2001 
but choose not to disclose his access until October 2001. LAMO 
utilized a vulnerability in MICROSOFT's network that allowed an 
unpublished Internet Protocol (IP) address to be entered into a 
web browser. The IP address provided access to records_of people 
who had bought products and services from MICROSOFT. 


6 -5 
contacted MICROSOFT to ask them for a comment for the story he bo -5 
was writing about the hack. This was the first instance, DIC -5 
MICROSOFT learned of the intrusion. MICROSOFT confirmed the hack 


and described the 
incident as "an error that led to a breach of privacy, against 
our privacy policy". 


In December 2001, LAMO contacted the reporter, | 

em to inform him that he had gained 

unauthorized access into MCI WORLDCOM's internal network. LAMO 

gained access to WORLDCOM's internal network in October 2001 but 

choose not to disclose his access until December 2001. LAMO 

provided internal screen captures to WORLDCOM to prove he was the b6 -5 

hacker. The screen captures from WORLDCOM's internal network c 

state, "Not to be reproduced in any manner or disclosed to bic -5 

unauthorized individuals". LAMO gained access to WORLDCOM's 

internal network using a free internet connection at KINKOS. 

LAMO exploited a vulnerability in a WORLDCOM proxy server to gain 

unauthorized access to their network. After committing the hack 

and reporting it to[____] LAMO commented "The downside is, I'm 

running out of major US Corporations". Also, one of LAMO's 

prized possessions is a screen capture of WORLDCOM's stock price 

falling after he announced he had hacked the company. 


2002, LAMO contacted the reporter,[_— 

to inform him that he had gained 
unauthorized access into SBC COMMUNICATIONS. LAMO gained access 
to SBC COMMUNICATIONS network in December 2001 but choose not to 
disclose his access until February 2002. WLAMO utilized an . 
exploit to gain access to SBC's internal network. LAMO used a b6 -5 
free internet connection at KINKO's to perform the hack. LAMO b7C -5 
gained access to usernames, passwords, telephone numbers, 
addresses and other sensitive customer information. 


In February 2002, LAMO discovered several misconfigured 
proxy servers acting as doorways between the public Internet and 
the NEW YORK TIMES private intranet. LAMO contacted of 

to inform him that he had gained unauthorized 
access Into ie W YORK TIMES intranet. LAMO utilized the proxy 
servers to gain access to the NEW YORK TIMES network.’ Once on 
the network, LAMO cracked a password for a userid with supervisor 
rights. Utilizing this userid he was able to broaden his access 
as well as perform certain functions within the network. LAMO 


FBI(19-cv-1495)-269 


_ New York 
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created four (4) Lexis/Nexus accounts off of the NEW YORK TIMES 
intranet and utilized these-accounts for himself and/or friends 
to run over 3,000 searches of individuals, address and/or court 
documents. 


LAMO has committed other computer intrusions into 
several other corporations such as AOL and EXCITE@HOME. Each 
time LAMO commits a computer intrusion on a high profile 
organization he reports the vulnerability and intrusion to the 
media causing a distrust of the company's clients. The above 
mentioned corporations have lost significant money and trust of 
their clients. 


Due to LAMO's vagrant lifestyle, numerous attempts to 


Writer and SA(__—S—Cé—“C;C JO thee NYO willl be assisting 
Squad SO-6 and will be coordinating efforts with the San 
Prancisco office regarding LAMO's arrest. 


b3 -4 


bé -1 
bY G1 
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To: New York From: New York 


LEAD (s) + 
Set Lead 1: (Info) 
NEW YORK 
AT NEW YORK 
Read and clear. 
Set Lead 2: (Info) 
SAN FRANCISCO 
AT SAN FRANCISCO 


Read and clear. 
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FEDERAL BUREAU OF INVESTIGATION 


Precedence: IMMEDIATE Date: 09/04/2003 


To: San Francisco Attn: | 


From: New York 
Squad DT-5 
Contact: SA 


Approved By: ALL INFORMATION TCNTAINED 


Title: ADRIAN LAMO; 
New York Times-Victim; 


Computer Intrusion; 
OO: NY 


Synopsis: Request permission for New York Office (NYO) agents to 
travel to San Francisco to locate and apprehend ADRIAN LAMO 


Administrative: Ref telcal 9/4/2003, SSA [ ___Janthorizes be -1 
travel of NYO agents to San Francisco to locate and apprehend b7c -1 
ADRIAN LAMO 


Details: On 8/1/2003, an arrest warrant was issued out of the 
Southern District of New York for ADRIAN LAMO based upon a 
complaint. The complaint charges LAMO with Computer Fraud and 
Trafficking in Accesses Devices. Specifically, LAMO is charged 
with hacking into the New York Times and Lexis/Nexus. Upon 
indictment, LAMO will be potentially be charged with unauthorized 
access into YAHOO, WORLDCOM, AOL, SBC, NEW YORK TIMES, 
LEXUS/NEXIS, MICROSOFT and CINGULAR. 


LAMO lives a vagrant lifestyle. He has labeled himself 
"the homeless hacker". He does not have a permanent residence 
nor does he have steady employment. Due to LAMO's lifestyle, the 
NYO's numerous attempts to locate him have been negative. 


Therefore, it is necessary for Technical Trained Agents (TTA's) b3 -4 
from New York travel to San Francisco with their_equipment to b7E -7 
i San Francisco TTA's in locating a0 | 
Once LAMO is located, the arrest of show e 
executed. 
-5 
telephone b6 -_ 
ystating that he is the attorney representing 7C -5 
Peal RS. 
Aro eR 
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To: San Francisco From: New York 
ee] 


gy iT 
LAMO. The letter states thatL____|believes his client is the P6 —95 
subject of a New York investigation and states that if we have buC. S5 
any questions for his client to please submit them in writing and 

he will respond in writing. 


Writer_has conferred with Assistant United States 
Attorney (AUSA) about the above mentioned 
investigation. AUSA stated that if and when LAMO is 
t 


b6é -4 
b7C -4 
Dorel 
Writer and two (2) TTA's from the NYO will be arriving 
in Oakland, California at 8:00PM on 9/5/2003. The two TTA's, SA 
[oe | and_SA will be assisted by San bé -1 
Francisco TTA Agreement between the TTA's has been b7C -1 


confirmed. Writer requests assistance from the computer 
intrusion squad with the apprehension and processing of LAMO on 
either 9/5/2003 or 9/6/2003. 


from San Francisco will 
TTA's. TTA's b7E -7 
writer and the assisting 
agents from San Francisco will effect the arrest. Writer requests 
the assistance from the San Francisco office for transport, 
processing, housing and arraignment of LAMO. 


¥ FBI(19-cv-1495)-274 


, Tor eS New York b3 -2 
Re: 09/04/2003 DIE —3 


LEAD (s) : 
Set Lead 1: (Info) 
SAN FRANCISCO 
AT _ SAN FRANCISCO 


Read and clear. 


had 
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FEDERAL BUREAU OF INVESTIGATION 


Date of transcription 09/08/2003 


Social 
who resides 


white male 


Security Account Number 
at 
telephone number 


was interviewed at his residence 
after being advised of the identity of the_interviewing agents and 
the purpose of the interview. Thereafter,[ _——sd provided the 
following information. 


is self suployed and provides some. 


knew_ADRIAN LAMOQ (LAMO) via 


would contact 


has not spoke with ramol sid Do <6 
stated that he hadL__—CiC:-- 6 


and LAMO became 
and never contacted _him again. WUAMO had asked 


€o reside with California. 


Investigation on 09/08/2003 a Oklahoma City, Oklahoma b3 -2 
be -1 
Fite Date dictated 09/08/2003 b7C -1 
Elite ry bIE -3 
y EBLCLO-cv-1495)-280. 
This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; 


it and its contents are not to be distributed outside your agency. 


wie | 


FD-302a (Rev. 10-6-95) 


b3 -2 


bo -6 
b7C -6 


bTE -3 


covimainorostzt — [_____d son 09/08/2003 yg 


was aware that LAMO at one time iiv ina 
where LAMO worked. thought 
a is office Was in Sacramento, California. 


had read in newsgroups that LAMO had done some ° ie 
consulting work for WORLDCOM and LEVI STRAUSS. Lo Jwas not bIC -6 
aware of where LAMO currently works. 
had read in newsgroups that LAMO accesses the 
internet at KINKO's. LAMO reportedly has his telephone number 
listed on LAMO's webpage at adrian.adrian.org. 
(L__] was aware that LAMO was at one time 
"did not have a good home life" and living on his own. 
described LAMO as "smart" and "brilliant." Be <5. 26 
r 
[was read a list of names provided by the NeD7C -5S, —6 
York Division of the Federal Bureau of Investigation. 
was_asked each name, and answered in the negative, with ss tion 
of oe aed 
(as previously mentioned 
b6 -5, -6 


and worked ob7C -5, -6 
as "removed" 


was described as a 
was a volunteer 
3. ier home in approximately 1996 or 1997. 


from LAMO is 
thought to be involved with i screen 
name is . 

worked at 2-1 
for was b6 -5, -6 
approximately 1996. b7C -5, -6 


stated that if he wanted to contact LAMO, he 
would use LAMO's website, or would send an email message through 
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FEDERAL BUREAU OF INVESTIGATION 


Precedence: ROUTINE Date: 09/08/2003 


To: New York Attn: 
Squad DT-5 
From: Oklahoma City - 
Squad 8 b3 2 


contacts sa[ 

bIC -1 

approved By: [__________] Dé@autt 4a }e03 DIE -3 
pratted By: [CAS ' 


Title: ADRIAN LAMO; | 
New York Times - Victim; 


Computer Intrusion; 
OO :NY 


Synopsis: Document result of investigative action 


Enclosure(s): Original and two copies of FD-302 of interview of 
original notes (1-A envelope) . b6 -l1, -6 


b7Cc -1, -6 


Details: 0On_09/08/2003 
interviewed 


The results of this investigation are documented in an 
FD-302. . 


Oklahoma City Division considers this lead covered. 


b3 -2 
bo -1 
b7c -1 
b7E -3 
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To: New York From: Oklahoma City b3 -2 


pet [| 9708/2008 22 


LEAD (s): 
Set Lead 1: (Info) 
NEW YORK 
AT NEW YORK 


Read and clear. 


had 
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: FEDERAL BUREAU OF INVESTIGATION 


Precedence: PRIORITY Date: 09/05/2003 
To: Sacramento Attn: SA 

San Francisco SA 

Cyber 


From: New York 
Squad DT-5 


bo -l 
Approved By: a 7 b7C -1 


pratted By: [7 tt bIE -3 


(Penfing) 


Computer Intrusion; 
OO :NY 


Synopsis: Request for assistance and update regarding ADRIAN 
LAMO investigation 


Administrative: Telcal 9/4/2003 to SA b6 -1 
Telcal 9/5/2003 to SA 

b7c -1 

Telcal 9/4/2003 to SA 


Telcal 9/5/2003 to SA 


Details: On 8/1/2003, an arrest warrant was issued out of the 
Southern District of New York for ADRIAN LAMO based upon a 
complaint. The complaint charges LAMO with Computer Fraud and 
Trafficking in Accesses Devices. Specifically, LAMO is charged 
with hacking into the New York Times and Lexis/Nexus with 
substantive counts mentioning WORLDCOM, SBC and MICROSOFT. Upon” 
indictment, LAMO will be potentially be charged with unauthorized 
access into YAHOO, WORLDCOM, AOL, SBC, NEW YORK TIMES, 
LEXUS/NEXIS, MICROSOFT and CINGULAR. LAMO lives a vagrant 
lifestyle. He has labeled himself "the homeless hacker". He 
does not have a permanent residence nor does he have steady 
employment. Due to LAMO's lifestyle, investigative efforts by the 
NYO to deocaveNiim have, been negative. 


b3 -4 
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The NYO contacted San Francisco agent 


regarding this information. In response to the NYO request, SA b+G.-s2. 
and other agents conducted surveillance in the area 
Arrangements _were 


made for the NYO's technical team and writer to travel tol 


At 4:30 PM (EST), writer received a telephone call from 
sa[ | Technically Trained Agent (TTA) stating that a 


The TTA was able toL___ 
The TTA further stated that the 

a a ee 

Writer conducted a check of all off 


[C~—“C;‘CSCSCSCCCSYT Write determined that[ 


‘in the immediate 


Writer contacted[_ Jagent3 -4 
[| —s—s—s~Ssxegarding this information. Writer explained to Sig _]  _5 
[ Tehat the DIC 4 a5 
2 , 


® @ ss. 
To: : New York DIE -3 


encouraged SA 
ee ee eee: See | 
other agents from theL_____—sidJof fice poorted the 


mission of the NYO and attempted to 


ae eer ee ees) 
sal jand the other agents were[ 
[ee 


[SAT Tleft the residence 
and made a SAI 


stated that he believed it] 
RAR ae cP a ET 


CH 
TIA's stated that] 


the residence and traveled by car 
The Sacramento office deployed their 


Surveillance Operations Group (SOG) to conduct surveillance on 


b7E -1 
[ue to these cixcumstances, the Nyo 
cn ee a 
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To: Sacramento From: New York BIE -3 
"Re: [7 09/05/2003 


tre curveiitionce met with negative 97° 


results. 


encouraged him to check the area and residence 


Securityfocus.com posted an article written by KEVIN 
POULSEN stating that the FBI had attempted to arrest LAMO at his 
parent's residence, POULSEN further stated that he spoke to LAMO 
and his mother directly to confirm the story and he is aware that 
LAMO is wanted by the FBI. 


The NYO is attempting to determine if LAMO created a 
The NYO has asked all field offices 
© interview over riends/associates of LAMO to determine his 
location and associations. The NYO is attempting to obtain a pen b3 
register (Cd 
b7E 
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_ To: Sacramento From: New York 


LEAD (s) : 
Set Lead 1: (Info) 
SACRAMENTO 
AT SACRAMENTO 
Read and clear 
Set Lead 2: (Info) 
SAN FRANCISCO 
AT SAN FRANCISCO 
Read and clear. 
Set Lead 3: (Info) 
CYBER 
AT CYBER er Be 


Read and clear. 


AA 
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Precedence: PRIORITY Date: 09/08/2003 
To: New York Attn: Press Office 


From: New York 
Squad DT-5 
Contact: SA 


approved By: [7 
pragtea ay: [Tes 
a a BIC Tas 
Title: ADRIAN LAMO; 
New York Times-Victim; 
Computer Intrusion; 
OO: NY 


Synopsis: Update regarding the arrest of ADRIAN LAMO 


Administrative: To follow up with phone call placed to writer by 
sa Jon 9/8/2003. b6 -1 
: b7c -1 
Enclosures: One (1) copy of article at TechTv.com 
One (1) copy of Trigger Street Productions website 


Details: On 9/5/2003, writer provided the New York Office (NYO) 
Press Office with a copy of the sealed complaint and arrest 
warrant for LAMO. Writer also provided the NYO Press Office with 
a copy of a summary of the case that was written for the 
Director's briefing describing in detail the status of the 
investigating and arrest of LAMO. 


On 9/8/2003, writer was questioned by | 
whether there was an arrest warrant for LAMO and whether LAMO was 
aware there was a warrant. Writer confirmed with ————= 
that there is an arrest warrant issued out of the Southern 
District of New York for LAMO and that LAMO is aware that there b6 -1 
is an arrest warrant for him and he is currently a fugitive. b7c -1 


; eaeecearl informed writer that reporters have been 
calling requesting a status of the investigation. SA 


informed writer he would tell the reporters that there Is an 
arrest warrant for his arrest and LAMO is aware of this fact. 


»:, Weiter informed saL_—sdt that on 9/6/2003, LAMO gave 
an interview Sixga, Local television news program in Sacramento, 
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To: New York From: New York 
re: [| 09/08/2003 


California. The news station was aware that LAMO was a fugitive 
from the law_but hosted his interview anyway. Writer also 
informed sal that a camera crew from Trigger Street 
Productions is traveling with LAMO to document his arrest by the 
FBI. 
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LEAD (s): 
Set Lead 1: (Info) 
NEW YORK 
AT NEW YORK ie i 


Read and clear. 
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Adrian Lamo Speaks With Leo Before Arrest 


The gray-hat hacker talked with ‘The Screen Savers’ as he waited to hear charges before 
turning himself in. 


By Tom Merritt 


According to SecurityFocus, Adrian Lamo, a famous hacker who exploits security holes and helps 
companies fix them, is being hunted by the FBI. Lamo called "The Screen Savers” at the top of the 
show. 


Lamo hacked into the website of The New York Times in February 2002 and took the Social Security 
numbers of several peopie. He then added his name fo the list of contributors to The New York Times 
and notified the paper of what he'd done. The Times responded by threatening to prosecute. 


This morning Trigger Street Productions, a multimedia production studio formed by actor Kevin 
Spacey in 2002, called Leo and mentioned that Lamo's parents were served with a warrant for his 
arrest. The folks at Trigger Street have stayed with Lamo to document his arrest. 


Adrian Lamo made arrangements with public defenders to turn himself in. He talked to us by phone 
before he did so. 


Two days ago, according to Lamo, the FBI tipped its hand and tet him know it wanted him. Lamo said 
the FBI wanted to search his parents’ premises, but his mother refused to let ifs agents in. According 
fo Lamo, the charges might relate to the criminal complaint by The New York Times. 


He said he intends to tum himseif in after he reviews the charges. Although the FBI isn't saying what 
the charges are, Lamo said he thinks he'll be allowed to know the charges before he turns himself in. 
He expects the charges to be reasonable and he said he'll defend himself rigorously. 


“This will not be a silam-dunk prosecution,” Lamo said. “[Bugl I'm worried. | don't know what's going to 
happen.” 


Lamo said he didn't know if he would be arrested immediately after he got off the phone. 


"It's a shame it had to come fo this," he said. “| intend to show that this sort of thing can't be seen as a 
deterrent. I've done things that peopte see as illegal and probably are iflegal, but I don’t think f've done 
anything wrong." 


“| don't think things happen by accident. | don't think that I've done anything wrong. | don’t think the 
FBI is doing anything wrong," he said. 


Lamo said he was going to a safe place to review his legal options after he had talked with us, 
although his lawyer has advised him to turn himself in as soon as humanly possible. Lamo also said 
he intends to answer for his actions. 


If the FBI refuses to show him the charges, he'll continue fo negofiate as a reasonable person, he 
said. 


“| appreciate alt the support that I've gotten," he said. "Having been there, | would not change anything 
that I've done... | hope the people out there considering their own courses in tife will not let the people cay. 
who want to criminalize curiosity let them stop what they want to do." FBI ioc 1495)-293 
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Trigger Street Productions, Inc., was formed in 1997 by Kevin Spacey to develop and produce 
entertainment in a variety of mediums. Realizing that the path to his own success would have 
been much rockier without the support and encouragement of many autstanding mentors, Spacey 
has sought out a way fo inspire, nurture, and help bring exposure to new and undiscovered talent, 
{f you are in a position to help others, if you find yourself in the building of life and you can send 
the elevator back down, that becomes your eamest duty. This philosophy has become the 
cafalyst for the second step of his vision - TriggerStreet.com. 


TriggerStreet.com was founded in January 2002 as the web-based filmmaker and screenwriter’s 
community of record - an interactive mechanism for the purpose of discovering and showcasing 
new and unique talent. Based on the principles of creative excellence, it provides industry access 
and exposure to help build the careers of notable new filmmakers and screenwriters of our day. 


Our mission is to encourage the creative process of filmmaking and screenwriting by providing 
hands on, peer-to-peer, objective criticism and letting the material be judged on its own merit, We 
offer an engaging avenue of exploration for both first time and veteran film directors, writers, and 
enthusiasts, anyone at all, who is atiempting to bring his or her vision fo the screen. 


Our team has been extensively researching and designing TriggerStreet.com to ensure that it 
encapsulates every aspect of the user's desires and needs. We are using the Intemet with its 
initial intention and design in mind: a fool to communicate. As such @ constructive tool, we hope 
that it will be an inventive, productive, and exciting experience for all. 


Welcome to TriggerStreet.com. 


_s Snes SM 
RLL INFORMATION CCHTRINES bo -1 
HEREIN 13 Ut 


TATE ¢ 


http://www .triggerstreet.com/gbase/Trigger/AboutUs 
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Rev. 01-31-3003) 


Precedence: IMMEDIATE Date: 09/08/2003 


To: Newark atta: sald 


From: New York 
Squad DT-5 


approved By: [MD b3 
bo 


peated ays [Jp 
rarlcte iy b7c 


-2 

-1 

-1 
Case ID #: ee: (Péndiing) DIE 4 


Synopsis: Second lead set to Newark to conduct logical 
interviews of associates of ADRIAN LAMO 


Administrative: As per email of 7) | on 9/8/2003, 


writer is resetting lead to Newark to conduct logical interviews 
of associates of LAMO. On 9/5/2003, writer informed Newark that 
it could conduct the interviews as LAMO was informed there was a 
warrant for his arrest and is currently a fugitive. 


On 8/7/2003, a New York Office (NYO) lead was 
sent to all interviewing offices updating them to the status of 
the investigation and the status of conducting the interview < 
LAMO's associates. . 


In first lead to conduct interviews of the below 


mentioned individuals sent on 7/2/ ided Newark 
with a hard copy packet containing ACS 
checks, criminal history, DMV history and Internet Checks on each 


interviewee, a copy of article from sfweekly.com of recent 
interview of the subject, ADRIAN LAMO, a list of suggested 
interview questions for each interviewee (Suggested questions 
worksheet), and a photograph of LAMO. New York has been informed 
that Newark is in possession of these enclosures and therefore 
believes that they do not need to be copied again and resent. 


pak: try ADRIAN LAMO is a twenty two (22) year old male who 
comm£es unalithorized computer intrusions into major corporations. 
LAMO is labeled in the media as the "homeless hacker". He 
considers himself a "white hat hacker". Investigation by the New 


b6 
bIC 


b7E - 
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To: Newark From: New York b3 -2 
fe: Dee foosoe/2003 be 3 


York Office has revealed that LAMO is a "black hat hacker", an 
individual who breaks into a computer system with the purpose of 
inflicting damage or stealing data. Each time LAMO hacks a major 
corporation he alerts friends in the media first and has them 
contact the victim for comment. 


In September 2001, LAMO hacked YAHOO! and rewrote the 
text of a YAHOO! News article. LAMO gained access through the 
portal's web-based production tools and modified a news story 
about DMITRY SKLYAROV, a Russian computer programmer facing BE <5 
federal criminal charges. LAMO used a free internet connection = 
at KINKOS to commit the hack. YAHOO! was informed of the breachb7C —5 
after being contacted b: who : 
was contacted by LAMO. was convicted in 1990's by the 
FBI for committing unauthorized computer intrusions. 


In October 2001, LAMO contacted the veporter,[ sd 


SS | inform him that he had gained 
unauthorized access into a MICROSOFT customer service database. 


LAMO had gained access to MICROSOFT's database is September 2001 
but choose not to disclose his access until October 2001. LAMO 

utilized a vulnerability in MICROSOFT's network that allowed an = 
unpublished Internét Protocol (IP) address to be entered into a bo -S 

web browser. The IP address provided access to records_of people b7C -5 
who had bought products and services from MICROSOFT. = 

contacted MICROSOFT to ask them for a comment for the story he 

was writing about the hack. This was the first instance, 

MICROSOFT learned of the intrusion. MICROSOFT confirmed the hack 

and described the 

incident as "an error that led to a breach of privacy, against 

our privacy policy”. 


In December 2001, LAMO contacted the zepeeter: [==] 
to inform him that he had gaine 
unauthorized access into MCI WORLDCOM's internal network. LAMO 
gained access to WORLDCOM's internal network in October 2001 but 
choose not to disclose his access until December 2001. LAMO 
provided internal screen captures to WORLDCOM to prove he was the b6 -5 


hacker. The screen captures from WORLDCOM's internal network bic -5 
-state, "Not to be reproduced in any manner or disclosed to 
unauthorized individuals". LAMO gained access to WORLDCOM's 


internal network using a free internet connection at KINKOS. 

LAMO exploited a vulnerability in a WORLDCOM proxy server to gain 
unauthorized access to their network. After committing the hack 
and reporting it to[___] LAMO commented "The downside is, I'm 
running out of major US Corporations". Also, one of LAMO's 
prized possessions is a screen capture of WORLDCOM's stock price 
falling after he announced he had hacked the company. 


FBI(19-cv-1495)-298 


To: : lew York 
b7E -3 


In February 2002, LAMO contacted the reporter,[_| 
to inform him that he had gained 

unauthorized access into SBC COMMUNICATIONS. LAMO gained access bo -5 
to SBC COMMUNICATIONS network in December 2001 but choose not to b/C -5 
disclose his access until February 2002. LAMO utilized an 
exploit to gain access to SBC's internal network. LAMO used a 
free internet connection at KINKO's to perform the hack. LAMO 
gained access to usernames, passwords, telephone numbers, 
addresses and other sensitive customer information. 


In February 2002, LAMO discovered several misconfigured 
proxy servers acting as doorways between the public Internet and 
a 4 intranet. LAMO contacted[__——sdo£ b6 -5 
© inform him that he had gained unauthorized p7ec -5 
access into The NEW YORK TIMES intranet. LAMO utilized the proxy 
servers to gain access to the NEW YORK TIMES network. Once on 
the network, LAMO cracked a password for a userid with supervisor 
vights. Utilizing this userid he was able to broaden his access 
as well as perform certain functions within the network. LAMO 
created four (4) Lexis/Nexus accounts off of the NEW YORK TIMES 
intranet and utilized these accounts for himself and/or friends 
to run over 3,000 searches of individuals, address and/or court 
documents . 
5 


LAMO has committed other computer intrusions into 
several other corporations such as AOL and EXCITE@HOME. Each 
time LAMO commits a computer intrusion on a high profile 
organization he reports the vulnerability and intrusion to the 
media causing a distrust of the company's clients. The above 
mentioned corporations have lost significant money and trust of 
their clients. 


In the enclosed San Francisco Weekly article, dated 
April 16, 2003, LAMO states "he is preparing to announce, in a 
few days, weeks or months -- whenever he decides the time is 
right -- his biggest hack yet. On the record, he defines his 
target as a "critical-infrastructure-related company"; off the 
record, he exhibits ample evidence of his repeated incursions 
into the corporations internal system.* NYO believes that LAMO 
is a threat to the infrastructure of the United States. 


The NYO along with the Southern District of New York 
(SDNY) have obtained an arrest warrant for ADRIAN LAMO. 


LAMO is reports to be homeless and usually stays with 
friends or in hostels for lodging. LAMO makes money in the 


col ity field whe es . 
to residence at bo -5 
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To: = lew York b3 -2 
Re: 09/08/2003 bIE -3 


-5 
LAMO keeps in contact with well known hackers be -S 
such as b7C -5 


The NYO has identified five (5) groups of individual 
who need to be interviewed regarding LAMO. In total 
approximately 225 individuals will be interviewed. The groups 
are as follows: 


1. Individuals he contacts via telephone 

2. Individuals he has close relationships with (Will 
be providing Grand Jury subpoenas) 

3. Individuals that were run in Lexis/Nexus 

4. Individuals whose IP addresses were used to run 
unauthorized Lexis/Nexus searches (Will be 
providing Grand Jury subpoenas) 

5. Individuals he is friends with but are reporters. 

(We are currently obtaining Department of Justice 

approval to conduct these interviews) 


This communication is to address the individuals with 
whom LAMO and/or others performed unauthorized Lexis/Nexus checks 
obtaining personnel information over a year ago and/or 
individuals LAMO contacted telephonically. Please note, when 
interviewing these individuals investigation may reveal a friend, 
acquaintance, family member or themselves, not LAMO who performed 
the Lexis/Nexus checks. If this is determined, conduct logical 
interview about that particular individual. Also, interviewees 
may and/or may not be aware that their personnel information was 
obtained by unauthorized individuals through Lexis/Nexus, please 
handle discretely. Writer has enclosed a list of individuals who 
may have been provided with the Lexis/Nexus userids by LAMO 
(included in the list of "other names" in suggested questions 
worksheet) . 


The NYO has conductea] id criminal BIE ~2 
history checks, DMV checks, ACS checks an meernet checks on all 


the individuals writer is requesting to be interviewed. Writer 
has put details pertaining to each interviewee in the leads 
section of this communication. Writer requests to be contacted 
by Agents who are assigned to conduct interviews either by 
telephone or email. The purpose of this request is to allow 
writer to contact the appropriate Agent to inform them of LAMO's 
arrest, so that interviews can be conducted. 


Interviews pertaining to individuals he has close 
relationships with, individuals whose IP addresses were used to 
run unauthorized Lexis/Nexus searches and individuals he is 
friends with but are reporters will be sent under a separate 
lead. The NYO office is currently obtaining Federal Grand Jury 
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To: 2 New York b3 -2 
Re: 09/08/2003 bE -3 


subpoenas and Department of Justice approvals for these 
individuals. 


FBI(19-cv-1495)-301 


To: Newark From: New York b3 -2 


Re: [09/08/2003 bie 3 


LEAD (s) + 


Set Lead 1: (Action) 


AT RIVERTON, NEW JERSEY 


Condi ical interview of 


Set Lead 2: (Action) 


NEWARK 


AT MOORESTOWN, NEW JERSEY 


Conduct logical intexview of [7B 
eee ey pre 
b3 -4 


Set Lead 3: (Action) 
NEWARK 


AT TEANECK, NEW JERSEY 


Set Lead 4: (Action) 
NEWARK 


AT WASHINGTON, NEW JERSEY 


pannus lwical_jntexview of Do 


Set Lead 5: (Action) 
NEWARK 


AT SPRINGFIELD, NEW JERSEY 


FBI(19-cv-1495)-302 


e a | 


Jo: Newark From: New York 


Conduct logical interview of be -5 
: b7c -5 
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Rev, 03-31-2003) 2 b 6 -1 
FEDERAL BUREAU OF INVESTIGATION b7C -1 
Precedence: ROUTINE Date: 09/08/2003 
To: New York ta: sa 
From: Honolulu : 


Squad 8 
Contact: SA 


approved sy: [diab no @ 
pragted py: [pipe be -1 


Title: ADRIAN LAMO; 
New York Times - Victim; 
Computer Intrusion; 
OO: NY 


Synopsis: To cover lead sent by New York dated 08/07/2003. 
Reference: 288A-NY-281568 Serial 87 


Details: After canvassing ail logical sources, no information 
was obtained regarding the location of Adrian Lamo. 


Honolulu considers this lead covered. 


BSS / COT TTN, 
lias 


5/835 
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To: zs Honolulu b3 -2 
Re: 09/08/2003 bIE -3 


LEAD (s) : 
Set Lead 1: (Action) 
NEW YORK 


AT NEW YORK, NEW YORK 


Read and clear. 


AA 
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MIRINED @ be -1 


PD-302 (Rev. 10-6-95) 


FEDERAL BUREAU OF INVESTIGATION 


Date of transcription 09/11/2003 


On September 10, 2003, | white, male, born - 
Social Security Account Number (SSAN) 


residence was 

interviewed at his 

place of employment, in reference to ADRIAN LAMO. LAMO is the og 

subject of a FBI criminal investigation concerning LAMO's be -5 

involvement in computer break-ins at the New York Times, Yahoo!, b7C -5 
AOL, Lexis/Nexus, Microsoft, and other major corporations. 

According to information from New York Division, name 


was run in Lexis/Nexus by LAMO or one of LAMO's associates. After 
being advised of the identity of the interviewing agent and the 
nature of the interview, Po Jprovided the following 
information: 


employment with the 


goals of gaining a degree in 
According to he is interested in means to 
and to do so, the 

capabilities 


must be knowledgeable of 
and methods. 


pits aware of the name ADRIAN LAMO, however he 

does not know LAMO personally. LAMO's name has been on the. 

Internet and_he is a well known hacker to those in the computer . 
industry. has never met or had contact with LAMO. b6 -5 
However , advised that he e-mailed LAMO in 2002 requesting b7C -5 
informati 


contacted by LAMO. 


CJ was not aware of any details surrounding 


computer intrusions by LAMO and was unable to provi ic 
information regarding those associated with LAMO. 


Investigation on 09/10/2003. a Alliance, Ohio b6 -1 


ee bee und 09/22/2003 gs 13 
by SA FBI(19-cv-1495)-310 


This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; 
it and its contents are not to be distributed outside your agency. 


ED-302a (Rey, 10-6-95) 


b3 -2 


Continuation of FD-302 of [7 von 09/10/2003 sais 


familiar with the names and _—aeees|| only as b6 -5 
they are well known in the computer field for hacking. p7c —5 


Was unable to provide any positive information 
regarding LAMO or LAMO's associates. 
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(Rev. 01-31-2003) 


FEDERAL BUREAU OF INVESTIGATION 


Precedence: ROUTINE Date: 09/11/2003 


To: Ney Aor Attn: Aavaa Dr- 
SA 


From: Cleveland 


Squad 6/Cant 
Contact: SA b3 -2 
approved bys [7d b6 -1 


b7c -1 
Case ID #: enging) 
Title: ADRIAN LAMO; 
New York Times-Victim; 


Computer Intrusion; 
00 :NY 


£7 
Synopsis: Provide New York Division with results of lead #12 b6 -5 
requesting the Cleveland Division to interview 
Alliance, Ohio. ba 2 


Enclosure(s): An original and two copies of an FD-302 containing 
the results of the interview of 


Details: On September 10, 2003.19 
regarding his knowledge of @Eria 
he has never met Lamo, is NStEaWETE of his location and is not 
aware of Lamo's associates.| sis aware of the name, Adrian 
Lamo, however he does not know Lamo personally. Lamo's name has 
been on the Internet and he is a well known hacker to those in 
the computer industry. 


intervil 


According to 


has an interest in 


FBI(19-cv-1495)-313 


_ @ 


To: :, Cleveland b3 
Re: 09/11/2003 bIE 


computer hacki i i By of his education and 
however does not-intend to utilize his skills to gain b6 -5 
unauthorized access to corporate or other business accounts. b7C 


Due to a of knowledge of Lamo and the 
veceipt of information that Lamo was arrested on September 09, 
2003 for involvement in the computer break-ins at the New York 


Times, Microsoft, Lexis/Nexus, Yahoo!, and other major 
corporations, the Cleveland Division considers this lead covered. 


FBI(19-cv-1495)-314 


To: Ne i Cleveland 82. 
Re: 09/11/2003 bIE -3 


LEAD ($s): 
Set Lead 1: (Info) 
NEW YORK 


AT NEW YORK, NY 


Read and clear. 
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(Rev. 01-31-2003) bIC 


FEDERAL BUREAU OF INVESTIGATION 


Precedence: IMMEDIATE Date: 09/11/2003 
To: New York 


From: New York 
Squad DT-5 


rafted ay: [7] eae 
b6é -1 
= BIC -1 


Title: ADRIAN LAMO; 
New York Times-Victim; 
Computer Intrusion; 
OO :NY 


Synopsis: Request permission for rental car while in Las Vegas, 
NV in connection with above mentioned investigation. 


Details: During the period of 7/31/03 through 8/4/2033, agents 
from the New York Office will be in Las Vegas, NV to apprehend 
the subject of the above mentioned investigation. To complete 
this mission it is necessary to have a rental car while in Las 
Vegas, NV. 


+ 
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bé -1 
DLE HL 
FEDERAL BUREAU OF INVESTIGATION 
Precedence: ROUTINE ° Date: 09/11/2003 
To: York Attn: Squ DT- 
oe oc ——$ 7 
From: Miami 
PB2/Ft. Pierce RA 
Contact: SA 
Approved Byh b3 -2 . 
Drafted By: [7D bird bo -1 
beC. =P 
Title: ADRIAN LAMO; 
New York Times - Victim; 
Computer Intrusion 
OO:NY 
Synopsis: Reporting the results of investigation at Orchid 
Island, Florida. 
b3 -2 
Details: Referenced communication_set a lead (Lead 22 bE 25 
Pierce RA to locate and interview pic —5 


As discussed with SA 


the writer was unable to 
determine a telephone number at 


residence and called 

to attempt to 

would be at this residence and b6 -l, -5 
available for interview. On 08/26/2003, telephonedy7ce -1, -5 
the writer regarding the purpose of the Interview. & 
advised that he was not familiar with name Adrian Lamo nor_was_he 

aware of any attempted intrusion of AO. 

advised that he would have the or 

ent in New York. Based on the response by 


advised to discontinue the efforts to 
in person. 


determine when 


interview 


Ft. Pierce considers this lead covered. 


Lye. bd -2 
8 
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: @ b3 -2 


To: New York From: Miami =3 
pet Ep i8/2003 


LEAD (s): 
Set Lead 1: (Info) 
NEW YORK 
AT NEW YORK CITY 


Read and clear. 


+ 
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b7c -1 


FEDERAL BUREAU OF INVESTIGATION 


Precedence: ROUTINE Date: 03/11/2003 


To: New York Attn: 
Squad DT-5 


From: Oklahoma City 
Squad 8 


Contact: SA 
Approved By: b3 -2 


prafted sys [x be -1 
a b7C -1 


Title: ADRIAN LAMO; 
New York Times - Victim; 
Computer Intrusion; 
OO :NY 
Synopsis: Document result of investigative action 


Enclosure(s): Original and two copies of insert from interview 
of 


Details: On 09/10/2003, writer and SA be -5 
interviewed [SY rommeriy pI 5 
in Ada, Oklahoma . 


The results of this investigation are documented in an 
insert. 


Oklahoma City Division considers this lead covered. 


FBI(19-cv-1495)-322 


Fosase lacs 


i 


To: ; Oklahoma City 
Re: 09/11/2003 


LEAD (s): 
Set Lead 1: (Info) 
NEW YORK 
AT NEW YORK 


Read and clear. 


had 


FBI(19-cv-1495)-323 


The following investigation was conducted by Special 
agent [and Jon 09/10/2003. 


now resides at 


[ formexivi 
Lo 


[L__Jadvised that she had no knowledge of ADRIAN LAMO 
or any other information pertaining to computer intrusions. 
aia not have any information to provide to the 
investigating agents pertaining to the questions provided. 


b3 -2 
be -1 
D7E* =a: 
b7E -3 


FL] 


SERIALIZED, 


APR 2.5 2004 
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Memorandum 


To 1: SAC, SACRAMENT 


Subject: Adnan Camo ie 
Mem York Times —N\ Cony 


on &/ 4/603 the sacramento Special Operations Group 
(SOG) conducted 4 physical surveillance in support of captioned 
investigation. 


; Hf 

Target: cian la Period Covered (Hrs): Ey - 98 

Target Observed? NO Photos Attempted?: NUO 

SUMMARY of observations: LOG ATTACHED ( ¥ ox) ee Bhn Ol [23 


Suruewllence, ristiated viccn: 
be -5 
Wu Ct nmarcdnao GP aE oe ’ n7e = 
le 1cL2 pasd of tin oln ie - 
Taaset wos pot tosecred , Sen ee 


deemumarted MO YO? gar 


SOG accomplishments: New pers. observed —_ New vehicles 
New locations —_ . Other: —_ 
(Explain "other" in space above) 


a 2 


oe ere 
(cover memo only. for‘ stats) 
vat ALOLr 


a Ce : 
Log reveiewed pie soe Supervisor 


FBI(19-cv-1495)-327 


ARRN 


L INFORMS 


TE G2-2 


t| 


7-76-02) 


Squad supervisor approval 
{please initial) 


‘Accomplishment involves: 


ICH CONTAINED 
REIN IS UNILASSTZ 


IE= 


RYS 


Accomplishment Report 
(Accomplishment must be reported and loaded into {SRA 
within 30 days from date of accomplishment) 


Date Prepared A 
Date Loaded 
Data Loader's Initials 


(check ail that apply) 


ae 


4-Used, but did not help 


Investigative Assistance or Technique Used 


m@& O8 OC 


11 Subject Resisted Arrest 
(i Subject Arrested was Armed 


Drugs o 3.- Helped, substantially 
AFueit 2-Helped, minimally . 4 - Absolutely essential 
uugitive a For Sub. Invest. Assist, by other FO (s) indicate ‘A,8,C,D for corresponding FO 
Bankruptey Fraud g Stat Agent Soc. See. No. ae £0 or ate FC 
‘Computer Fraud/Abuse 6&1 co: Gout | b6 -l-4 
Corruption of Pubic Ofeiats 2) Sal Agent Name com t ] b7c -14 
Money Laundering Oo DIE 3. 
Sub Invest Asst by FO(s) CO - Nat. Back ! ar 
———_————} CAVE /VI- CAN b3 -2o0r 
Asst. FOS), _. — — = 
TIMING Intel Asst JO Wanted Flyer 
isis Neg. - Fed. SARS 
Task Force risis Neg. - Local ART 
ERT Asst. \sset Forf Prog 
Assisting Agencies x * |Butte- IT | ‘orf Support Pro} 
4. |sav- ite | 
2. Po - ITC l [ 
A. Complaint/tnformation / Indictment F. Conviction J. Civil Rico Matters Date: 
UFederal [) Local (International Federal [) Lecat [international Also Complete "Section @” 
Complaint Date: Conviction Date: Other Civil Matters Date: 
Cheek if Civil Rico Complaint 3 Subject Description Code: sudgment —_ _________ 
Information Date: ; . Judicial Outcome * 
Information Date: For 6F, G, H-include Agency Code Amount § 
indictment Date: 1 Felony or ( Misdemeanor Suspension: Years Months 
B. Locate/ Arrest O Plea or = DD Tiiat 
Federal O) Local C1 International State: Judiciat District: K. Administrative Sanction Date: 


G. U.S. Code Violation 
Required for sections A,8,Fand J 
(Federal Only) 
Title Section # Counts 


StS OBOE SUMAN) 


. Summons Date: 


O Federal Local 


hase. (OR? (a) C2) 


D. Recovery/Restitution/PELP X 
Ci Federal (] Locai L international 


Recovery Date: 

Code * v Amount §. 

Code ¢ ¥ Amount $. 

Restitution Date: 

CiCourt Ordered] Pretrial Diversion 
Code * ¥ Amount $, 

PELP Date: 

Code * ¥ Amount $. 


H, Sentence Date: 


Sentence Type: ht. . 
In Jail: Years, Months 
Suspended: Years. Months 
Probation: Years. Months 
Fines: $. cdl 


Subject Description Code. . 
‘Type: Length: 

U Suspension [J Permanent 
UJ Debarment or 

BD Injunction 


gy 


Year, 


Mofths™= 
Mofiths? 


r 


Asset Seizure Date: 
Asset Forfeiture Date: 
CATS # Mandatory 
Circle below one of the three asset forfeiture: 
Admin, Civil Judicial, or Criminal 

Do not indicate $ value in Section D 


Disruption/Dismantfement: / 


E. Hostage(s) Released Date: 


Disruption Daje® 


Released by: L)Terroist_[].Otner 


Neer of soe 


Dismant]s ent Date: 
np 


Completion of FD-515a Side 2 Mandatory 


ild located/iderttitied Date: 
1 Living Deceased 


Drug Seizure: 
Drig Code * 
Weigh! 
FOIN 
Do pot indicate $ valugiin, Seahion D 


0. Chil 


P._sifbject information - Required for all blocks exefeaing block D (Recovery/PELP), blocks E, 


=~ 


5A) 


> J, 0, and N. 
t Name Race *[ Sex | Date of Birth | Sootal Security No. (Ravallabley 
tips ULF ON SO. Cb 0 | 79 \|8-kO-LG) O28 7 - OO 


Eor Indiétments/Convictions only: 
Complete FD 


Complete FD-5154, Side 1 Blocks A-G oni 


‘Subject telaled to an LCN, Asian Organized Cae (AOC), Italian Organized Crime (IOC), Russian/Eastern European, Caribbean, or Nigerian Organized Cxme Group - 
aSide 1 Blocks A-E mandgfory, F-H as appropriate, 
(1 Subject related to an OC/Drug.Qiganization#a VEMO Program National Gang Strategy target group, or a VCMO Program National Priority titative tas group - 


7 


X Additional information may be added by attaching another form or a plain sheet of paper for additional entries. 


+ See codes on reverse side. 


¥ Requires that an explanation be attached and loaded into ISRAA for recovery over $im and PELP over $5, disruption, dismantiem: 


FBI(19-cv-1495)-328 


sa: ALL INFORMATISN CONTAINE? 
EREIN IS UNCLASSIFIED 


10 BY Co} 


TE C2-27-) 


For Further Instructions See: MAOP, Part II, Sections 3-5 thru 3-5.3. 


PROPERTY CODES 


1 Cah 

©2 Stocks, Bonds or Neyet. Instruments 
03 General Retail Merchandise 

4 Venictes 

05 Heavy Machinery & Equipment 
96 Aircraft 

97 Jewelry 

08 Vessels 

09 Ant Antiques or Rare Collestions 
Hi Real Property. 

20 All Other 


SENTENCE TYPES 


CP Capital Punishment 

JS Jail Sentence 

LP LifePacote 

LS Life Seatence 

NS No Sentence (Subjects a Fugitive, 
Ankane, has Died, or fsa 
Corporation) 

PB Probation 

SI Suspension of Sail Sentence 

YC Youth Corcection Act 


PELP CODES 


22 Counterfeit 
‘Stotks/Bonds/Currency? 
Negotiable insinsments 

2B CountereivPirated Sound 
Recotdiags or Mation Pictures 

24 Bank Theft Scheme Aborted 

25. Ransom, Extortion or Bribe 
Demand Aborted 

26 Theft From or Fraud Against 
Government Scheme Aborted 

27 Commercial or industrial 


“Theft Scheme Aborted 
30 All Other 
ORGANIZED CRIME 
SUBIECTS 

IF Boss 

1G Undesboss 

JH Consigtiere 
Acting Boss 

1K Capodecina 

IL Soldier 
KNOWN CRIMINALS 


2A FopTenorl.0. Fugitive 
2B Fop Thiet 
2C Top Con Man 


FOREIGN NATIONALS 


3A Legal Alien 

3B legal Alien 

3C Foreign Offictat Wout 
Diplomatic Immunity 

3D UN. Employee Wout 
Diplomatic tmmunity 

3E Foreign Student 

3F All Othees 


TERRORISTS 


4A Known Member of'a 
‘Tetsorist Organization 

48 Possible Terrorist Member 
 Syrapathizet 


RACE CODES 
A Asian/Pacific Istender 
B Black 

1 IndianfAmerican 

U_ Unknown 

Wo White 


X — Nonindividual 
AGENCY CODES 
AFOIS Ais Force Offic of Special Investigations 


ACIS Acmy Criminal investigative Service 
BATE Bureau of Alcohot, Tobacco &; Fisearms 


BIA Butea of indian Affairs 
BCAA Defense Contract Audit Agency 
DCIS Defense Criminat Javestigative Service 


DEA Drag Enforcement Administration 
DOC —_Department of Corrections 
DOE —_Dept. of interior 


EPA Environmental Protection Agency 
FAA Federal Aviation Administration 

EDA Food and Drug Administration 

HS Dept. of Heaith & Human Services 
HUD Dept, of Housing & Urban Development 
INS —_eamigration ané Naturalization Service 
IRS__tntecnai Revenue Service 


NASA Natl Acronautics & Space Admin 
NBIS Natl NARC Botder Interdiction 
NCIS Naval Criminal Investigative Service 
RCMP Royat Canadian Mounted Police 
SBA Smal Business Administration 
USP US, Border Pateo! 

USCG US. Coast Guard 

USCS US. Customs Service 

USDS US. Department of Sta 

USMS US. Marshals Service 

USPS US. Postal Service 

USSS US. Sceret Service 

USTR US. Treasury 


LOC Local 
CITY City 
COUN County 
ST State 
OTHR Other 


SUBJECT DESCRIPTION CODES 


UNION MEMBERS 


5D President 
SE Vice-President 

SF Treasurer 

5G Secretary/reasurer 

SH Executive Boaé Member 
Si Business Agent 

SY Representative 

SK Organizer : 
SL Business Manager 

SM — Flanciat Secretary 

SN Recording Secretary 

SP Office Manager 


3Q Clesk 
SR Shop Steward 

SS Member 

ST Trustee 

SU Other 
GOVERNMENT SUBJECTS 


(GF, 6G, 6H. Include Agency Code) 


6A Presidential Appoinice 

6B US, Senstor/Staf 

$C US, RepresentativetStalt 

6D Federal judge/Magistiate 

$8 Federal Prosecutor 

6F Federal Law Enforcement Officer 
6G Federal Employee -GS 13 & Above 
SH Federal Employee GS 12 & Below 
8} Governor 

6K Lt. Governor 

SL State Legiststor 

6M State fudge/Magistrate 

GN State Proscevtor 


JUDGMENT CODES, 


Consent udgment 

CO Cour Ordeced Settlement 
DF Defautt udgment 

DI Dismissal 

JN Judgment Norwithstanding 
MV Mined Verdier 

SI Summary Judgment 
VO Verdict for Defendant 
VP Verdict for Plaintft 


- JUDICIAL OUTCOME 


AG Agrecment 
BR Barred/Removed 
cc i 
DC Disciplinary Charges 

Hl Fine 

PL Preliminary Injunction 
PR Temporary Restraining Osder 
PS Presfiling Settlement 

RN Restitotion 

SP Suspension 

YR Voluntary Resignation 

OT ther 


DRUG CODES 


COC Cocsine 
HER Heroin 

HSH Hashish 

KAT Khat 

LSD LSD 

MAR. Marijuana 

MDM Methylenedioxymethampheiamine 
MBT Methamphetamine 

MOR Morphine 

‘OPM Opium 

OFD Other drugs 


DRUG WEIGHT CODES 


GM Gram(s) 
KG Kitogram(s) 

L Lieris) 

Mi Mililitertsy 

P Plants) 

DU Dosage Unit(s) 


Continuation of GOVERNMENT SUBJECTS 


6S Local Legislator 
ST Local Judye/Magistrate 
SU Local Prosecutor 
SV Local Law Enforcement OMlicer 
ow 6 

State Law Enforcement Officer 
6Q State~ Ail Gihers 
6R_ Mayor Local - Ail Others 
6X County Commissioner 
6¥ City Councilman 


BANK EMPLOYEES, 


TA Bank Officer 
7B Bank Employee 


OTHERS 


BA All Other Subjects 
8B Company or Corporation 


CHILD PREDATORS 


9A Child Care provider 
9B Chessy 

9 Athletic Coach 

9D" TeachediAide 

9E Law Enforcement Personne! 
9F Counsetor 

9G Relative 

OH Stranger 

Other 


FBI(19-cv-1495)-329 


Page 


09/17/2003 


Case Numbel 
Serial No. 


Does Accomplishment Involve 


Bankruptey Fraud... . . 
Computer Fraud/Abuse. 
Corruption of Public Officials: N 
Money Laundering. . 2... .2N 


Sub. Invest. Asst by Other FOs: 


Investigative Assistance or Technique Used 


Assisting Joint Agencies 


FINAN ANALYST LAB DIV EXAMS: 1CO-GROUP 1 FT. MON-NRCSC 
AIRCRAFT ASST LAB FIELD SUP ICO-GROUP IT FOR LANG ASST 
COMPUTER ASST PEN REGISTERS |UCC-OTHER INCN FBT LAB EX 


CONSEN MONITR PHOTOG COVERGE 


INCAVE/V1-CAP 


VICT*WITN CCOR 


ELSUR/FISC POLYGRAPH CRIM/NS INTEL IG WANTED FLYR 
ELSUR/TIL ISRCK WAR EXEC CRIS NEG-FED SARS 
ENG FIELD SUP SHOW MONEY CRIS NEG-LOC CART 
ENG TAPE EXAM SCG ASST ERT ASST |ASSET FORF PRO 
LEGATS ASST. SWAT TEAM BUTTE-ITC IFORF SUPPORT P 


EVIDNCE PURCH 
IINFORMANT/CW 


TECH AG/EQUIP 


TEL TOLL RECS POC-WRCSC 


SAVANNAH - ITC 


Assisting Agents soc 


09/17/03 15:13:24 


Report Date: 09/17/2003 
Accom Date.: 09/09/2003 bo -1 


Subject Name 


LAHO, ADRIAN 


RA Squad Task Force 


Used, but did not help 
2 = Helped, Minimally 

3 = Helped, Substantially 
4 = Absolutely Essential 


bDI7E 


Arrest is for Federal, Local, or International (F/L/1) 


Arrest Subject Priority (A/B/C). 
Did Subject Resist (Y/N) 
Was Subject Armed (Y/N). 


BB pn 


FIVE / UNCLASSIFIED 


FBI(19-cv-1495)-330 


Tm 
SERIALIZED. 


: b7c -1 
SEP ae mee een 
Sheth YSbTE -3 
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United States Attorney 
Southern District of New York 


FOR IMMEDIATE RELEASE CONEACT: U.S. ATTORNEY'S OFFICE 
SEPTEMBER 3, 2003 MARVIN SMILON, HERBERT HADAD, 


MICHAEL KULSTAD 


ALL INF: PUBLIC INFORMATION OFFICE 


EEREIN 

“ATE 92-2 (212) 637~2600 be <1 
FBI NARK F. MENDELSORT b7C -1 
JOSEPH A. VALIQUETTE (212) -637-2487 


JAMES M, MARGOLIN 
(212) 384-2715, 2720 


0.8. € ES HACKER WITH TLLEGALLY 
ACCESSING NEW YORK TIMES COMPUTER NETWORK 


JAMES B, COMEY, United States Attorney for the 
Southern District of New York, and PASQUALE D’AMURO, the 
Assistant Director in Charge of the New York Office of the 
Federal Bureau of Investigation, announced that. ADRIAN LAMO was 
charged in Manhattan federal couxt with hacking into the internal 
computer network of the New York. Times. LAMO surrendered teday 
to federal authorities in Sacramento, California. 

According to a two-count criminal Complaint 
unsealed today in Manhattan federal court, on February 26, 2002, 
LAMO hacked into the New York Times’ internal computer network 
and accessed a database containing personal information 


{including home telephone numbers and Social Security numbers} 


SEP-@3-20@3 16312 FBI NYO PRESS OFFICE 2123842247 PF. G2704 


for over 3,000 contributors to the New York Times’ Op-Ed page. 

As described in the Complaint, soon after being 
notified of the computer intrusion, the New York Times conducted 
an internal investigation and confirmed that an intruder had in 
fact hacked into its network and accessed the personal 
information for contributors to the Op-Ed page. In addition, 
according to the Complaint, the Times determined that the 
intruder had added an entry to that database for “Adrian Lamo, “ 
listing personal information including LAMO‘s cellular telephone 
number (415) 505-HACK, and a description of his areas of 
expertise as “computer hacking, national security, communications 
intelligence.” 

The Complaint states that the New York Times later 
learned that while inside ite internal network, LAMO had set up 
five fictitious user identification names and passwords 
(“userids/passwords”}) under the New York Times’ account with 
LexisNexis, an online subscription service that provides legal, 
news and other information for a fee. .The Complaint charges that 
over a three month period, those five fictitious 
userids/pagswords conducted more than 3,000 searches on 
LexisNexis; in the month of February 2002, the five 
userids/passwords conducted approximately 18% of all searches 
performed under the New York Times account. 


According to the Complaint, the unauthorized LexisNexis 
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searches included searches for “Adxian Lamo”; searches for other 
individuals with the last name “Lamo”’; searches using the 
Northern California home address of LAMO’s paxentg; searches for 
various reputed hackers; and searches for various known 
associates of LAMO. The LeuisNexis charges incurred by these 
five accounts was approximately $300,000, according ta the 
Complaint. 

In an interview with a reporter from an online 
publication called ‘SecurityFocus,Com” later on February 26, 
2002, LAMO admitted thet he was responsible for the New York 
fimes intrusion, it was charged. 

The Complaint also identifies a series of other 
computer intrusions for which LAMO has acknowledged 
responsibility in interviews with members of the press. In 
some instances, according to the Complaint, LAMO personally 
admitted responsibility for the computer intrusion to 
representatives of the victimized company, explaining how he 
hacked their computer network, and providing corroboration that 
he was, in fact, the intruder. ‘he other intrusions, and the 
approximate dates according to the charges, are: (1) Excite@Home, 
May 2001; (2) Yahoo!, September 2001; (3) Microsoft, October 
2001: (4) MCI WorldCom, November 2001; (5} SBC Ameritech, 
December 2001; and (6) Cingular, May 2003. 


LAMO, 22, is scheduled to be presented before a United 


FBI(19-cv-1495)-334 


SEP-@3-2023 16:15 


e NYO PRESS OFFICE " 2123842247 PP .aavad 


moe, 

States Magistrate Judge in Sacramento, California, federal court 
later today, 

If convicted, LAMO faces a maximum sentence of 15 years 
in prison and a $500,000 fine. 

Mr. COMBY praised the investigative efforts of the 
Federal Bureau of Investigation’s Cybercrime Task Force and 
Computer Hacking and Intellectual Property Squad, and also 
thanked the New York Times, LexisNexis, Yahoo!, Microsoft, MCI 
Worldcom, SBC Ameritech, and Cingular for their assistance, 

Assistant United States Attorney MARK F. MENDELSOHN is 
in charge of the prosecution. 

The charges contained in the Complaint are merely 
accusations and the defendant is presumed innocent unless and 
until proven guilty. 


03-216 aed 


TOTAL P.a4 
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FEDERAL BUREAU OF INVESTIGATION 


L- NYG wee 
b6 -1 
b7C -1 


Precedence: ROUTINE Date: 09/15/2003 


To: New York Attn: Squad _DT-5 
sab 


From: Philadelphia 
Squad 08 


Approved By: ; 
smiles 


Drafted By: b3 -2 
y b6 -1 

G ID 

ase # Pending) pyc —1 

Title: ADRIAN LAMO; b7E -3 


New York Times- Victim; 
Computer Intrusion; 
OO :NY 


Synopsis: Lead covered. b3 -2 


: 
Reference[ | ES pIC -1, -S 
Details: On July 21, 2003, FBI New York set FBI Philadelphia to 
interview[ 


On August 22, 2003, Special Agent (SA) 


Squad _ 08, FBI Philadelphia conferred with his squad mate, 
SA referencing the lead set by FBI New York. SA 
met with a source to discuss the above captioned subject and 


discussed the contents of that meeting with the case agent, SA 
Squad DT-5, FBI New York. 


SA informed the lead agent, sal] that the 
material covered in the source meeting covered the 1léad to 
interview 


FBI Philadelphia considers the lead covered and no 
further investigation necessary at FBI Philadelphia. 


b3 -2 
bo -1 
b7c -1 
b7E -3 
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To: New 
Re: 


LEAD (s) 
Set Lead 


NEW 


York From: Philadelphia 
09/15/2003 


i: (Info) 


YORK 


+ 


AT NEW YORK, NEW YORK 


Lead covered, read an 


d clear. 
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FORMA 


TISH CONTAINES 


TNTLAS. 
(Rev. 01-31-2003} “200 b6 -1 
FEDERAL BUREAU OF INVESTIGATION bic -1 
Precedence: ROUTINE Date: 03/17/2003 
To: Mew York Attn: Squad DT-5 
SA 


(212) -384-3611 


From: Springfield 
Squad 7/Quad Cities RA 


Contact: 
approved Bye [TT et/mm oe 
prattea py: [Tish b6 -1 


b7c -1 
case ID a{ (Petding bIE -3 


Title: ADRIAN LAMO; 
New York Times-Victim; 
Computer Intrusion; 


Synopsis: To report lead covered. 


Enclosure({s): Enclosed for New York are the following: 


1. One_original and two copies of an FD-302 reflecting b6 -5 
the intetview off anc 5 


2. One FD-340 (1A) envelope containing the original 
notes of interview. 


Detailss [] and[__ were b6 -5 
interviewed with regards to their knowledge of Adrian Lamo and) p7c —5 
unauthorized computer intrusions. (ee eee] 


and did not know Lamo, his associates, or his 
current whereabouts. 


is the brother of and the son b6 <5 


and can be reached by cellular phone See b7c -5 
FD-302 for any more details concerning the interview and the 
captioned matter. 


As Springfield has conducted all necessary 
investigation requested by New 
lead covered. ’ 


2G0iRL OL 


To: New 
Re: 


LEAD(s) 
Set Lead 


NEW 


cy 


York From: Springfield 2 
09/17/2003 OTE -3 


1: (Info) 


YORK 


+ 


AT NEW YORK, NY 


Read and clear. 


FBI(19-cv-1495)-339 


. NED 
FD-302 (Rev. 10-6-95) 


[fe 3 b6 -1 
b7C -1 
a 
FEDERAL BUREAU OF INVESTIGATION 
Date of transcription §=_ 09/17/2003 
-1, -5 
-1, -5 


are not employed. After being 


advised of the purpose of the interview and identity _of the 
interviewing agent and req 


provided the following information: 


-5 


be -l, 
[ana did neb'TC -1, -5 
ADRIAN LAMO nor could they describe him. 
LC andl S—=*d hid not know any of the details pertaining to 


the unauthorized intrusions, provided by saL_____d LAMO'S current 
whereabouts, [ names of acquaintances, financial matters, 
screen names, and associated web areas or chat rooms, were not 


known . 

andc_—S—s—“C™;CSCs GG not knb6 -1l, -5 
LAMO; consequently, they have never let LAMO use their internet p7¢ -1, -5 
comnection to access the internet, nor has LAMO ever used their 


phone and [7] and 


the sister of is currently residing_in the 
area and can be reached by cellular prone |) 


No other names on list, provided by SA were 
recognized. 

Cd, ma [____Thave a base -1, -5 
knowledge of computers and online functions; however, they have p7c -1, -5 
never chatted online with LAMO at anytime. b3 -2 ’ 

If any new information become i regarding thib7E -3 
matter, and 
provide To 


—— 


ee a Cc) 
coe L__ |} @—~ 
b3 -2 


Investigation on 09/15/2003 at Bettendorf, Iowa 7 1 


wy SAL] FBI( 19-cv-1495)-340 DIE ~3 


‘This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency, 
it and its contents are not to be distributed outside your agency. 


Rev. 01-31-2003) 


b7c -1 
FEDERAL BUREAU OF INVESTIGATION 
Precedence: ROUTINE Dates 09/16/2003 
.To: New York Attn: S$ = 
ee 
From: Sacramento 
FRA2/Fresno 
Contact: 
N 
Approved By: i bs. F2 
Drafted By: ame + b6 -1 
b7C -1 

ee ee od be =3 
Title: ADRIAN LAMO; 

New York Times-Victim; 

Computer Intrusion; 

00: NY 
Synopsis: To report findings of logical interview conducted at 
areas en eee ee eee eer es b6é -5 
Enelosure(s): Two copies of the FD-302 6 ——_ a] b7C -5 


Details: [ss CSC™~C~C~C WS CONC AE 

Fresno, California, telephone_number 
stated that she does not know a and that she has lived 
at the above address_for 10 years. could not provide any 
more information on 


Additional information for case agent: The security 
for the gated subdivision stated that he did not know of a b6 -5 
that lived in the community; however there is a b7C -5 
an attorney, that is out of the state at the ss 
current time that lives in the community. 


Inasmuch as no further investigation remains in the 
Fresno RA territory, this lead is considered covered. 


b3.-=2 
bé -1 
b7c -1 
b7E -3 


48 Ce ae. 


To: 
Re: 


@ 
es 


LEAD (s) 


Set 


+ 


Lead i: (Info) 
NEW YORK 


AT _NEW YORK 


Sacramento 
09/16/2003 


For information only. 


b3 -2 
bIE -3 
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ED-302 (Rev. 10-6-95) 


bé -1 
b7c -1 


-l- 
FEDERAL BUREAU OF INVESTIGATION 
Date of transcription 09/17/2003 
-5 


b6 
home telephone contacted on her home p7c — 


—— 5 
telephone. After being advised of the id of the interviewing 
agent and the nature of the interview, []providea the 


following information: 


| has lived_at the above address for 10 years. 
has never heard of| and believes that there is no 


one with that name living in their subdivision. 


Investigation on 09/17/2003 at Fresno, California (telephonically) 


oy Date dictied 09/16/2003 
wy Penn FBL(19-ev-1495)-344 


This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; 


it and its contents are not to be distributed outside your agency. 
inpoaz{___] zadaee,wed 


tps 


FD-302 (Rev. 10-6-95) 


ALL INS. 
BEREIN I 


bo -1 
b7c -1 


FEDERAL BUREAU OF INVESTIGATION 


Date of transcription _09/18/2003 


date of birth 
was interviewed 


white male 
L “Jsecial Security Account_number 
at his resi at 


b6 -6 
b7C -6 


being advised of the official identities of the interviewing 
agents,|_|provided the following information: 


ocally and was sentenced to probation until 2014. Additionally, 
[___]was sentenced to make restitution payments to his victims. 


and his e-mail address is 


has received no formal computer training and has be -6 
completed up until his Junior year in high school. He advised_that_b7C -6 


he learned all of his computer and hacking skills on his own. 
started reading UNIX books and manuais[ does not 
spend_much time on his computer, with the exception Of working on 


his Sincel___]was convicted emma 
he tries to avoid spending too much time On Ais 


computer. commented that he still maintains contact with the 
hacker world, even though he no longer executes hacks. 


[ |icentities ADRIAN LAMO from a photograph that was b6 -6 
presented to him.[  |has_ never had personal or telephonic b7C -6 
contact with LAMO; however,[-__loffered LAMO lodging if he were ve. SO 


ever to visit the Colorado Springs area. used to communi 
with LAMO via the Internet approximately 
has had no contact with LAMO since LAMO hackKéd into ie YORK 


My 


Investigation on _ 09/17/2003 _, a Colorado Springs, Colorado C i 
6s 
File Date dictated b7C -1 
SA 
iy. BR FBI(19-cv-1495)-349 Dyer? 


This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; 
it and its contents are not to be distributed outside your agency. 
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FD-302a (Rev. 10-6-95) < . 


DIE -3 
coinninotrosar [| son 09/37/2003 oye? 


. b3 -2 
b6é -6 


believes that LAMO is modest about his hacking b6 -6 
ability. advised that LAMO was trying to prove a point that b7IC -6 
people sacrifice internet security for convenience. Everyone has a 
false sense of security that their personal information is safe. 

advised that LAMO could gain access to anyone's Social 

Security Number, phone number, banking information, and other 
personal information. But when LAMO did gain access, his intention 
was to show people and businesses that they are vulnerable to 
intrusion, not _ to steal information or use his ability for personal 
benefit | described LAMO as being very philosophical, 
insightful, intelligent, and articulate. 


[-“Jadvised that LAMO lives somewhere on the West Coast 
and previously worked or_volunteered his time to a gay and lesbian 


charitable organization. has no knowledge of LAMO'S family or 
where LAMO spends his time. is aware that LAMO'S nickname is 
"Homeless Hacker"; however, he never spoke to LAMO about being b6 -6 


homeless because he thought that it might be a sensitive subject bic -6 
for LAMO.[_|does not have any knowledge of LAMO'S financial 

status or from whom LAMO receives money.[_|has not participated 

in_any of LAMO'S intrusions and LAMO has not provided information 

tol regarding company computer vulnerabilities, back doors, 

open networks, or hacking tools.[__ Jadvised that LAMO was aware 

of his legal trouble; therefore, LAMO did not want to make the 

situation worse by getting involved with his intrusions. 


LC Jreaa that LAMO used an old laptop computer that is be -6 
missing three keys. advised that LAMO uses STARBUCKS and b7C -6 
KINKOS to access the Internet, but he has no knowledge of the 
locations of either business. 


mainly learned about LAMO'S va 
intrusions from reading online news articles. 
was aware of ! i i 
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be -6 


bIC -6 
Bb -2 


DIE -3 


Continuation of FD-302 of ,0n ©? /17/2003 , Page see 


eee 


In regard to LAMO'S specific intrusions,L _ hdvised 
that LAMO used_hacking tools readily available over the Internet. 
According to HLAMO would 


LAMO also gained knowledge through " 


CL Jadvisea that he never gained or dissemi 
information regarding LEXIS NEXUS Logins or passwords, 


former for LEXIS NEXUS as 
a_data entry person. believes tha lives inl] 


cz ay 


include bo -5, -6 
works as a journalist for b7c -5, -6 
been involved with constructing the 
© gain support for LAMO'S cause. A 


erson that freguently posts information on the website is n 
further information regarding 
commented that and LAMO most likely communicate daily since 


sympathizes with LAMO and understands his legal situation. 


served as 


name was 
er of included 
a man named from Chicago. 
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FEDERAL BUREAU OF INVESTIGATION 


Precedence: ROUTINE Date: 09/19/2003 
To: lew York Attn: SA 
Squad DT-5 
From: Denver - 
CSRA/SQ b3 -2 
Contact: be -l 


b7C -1 
Drafted By: he 
cue YE Kon 
Title: ADRIAN LAMO; 
New York Times-Victim; 


Computer Intrusion; 
OO :NY 


Synopsis: To report interview off ——sion 09/17/2003. D6 -6 


b7C -6 
DIE 


. -3 

Enclosure(s): Enclosed for New York are two (2) copies of the 

FD302 regarding the interview Se oe et) co 09/17/2003b6 -1, —-6 
and the corresponding FD340 envelope containing interview notes 57°C -1, -6 
and a photograph of Adrian Lamo utilized during the interview. 


03/17/2003 [ DOB SSAN L 

i iewed at his residence located at P 

Colorado Springs, Colorado Ww 
ny Special Agents |] 


of the Colorado Springs Resident 


Agency, Denver Division. 


Inasmuch as all lead requests were addressed, Denver 
considers this lead covered. 


b3 -2 
bé -1 
b7C -1 


we DIE -3 


FBI(19-cv-1495)-352 


From: Denver 
09/19/2003 


1: (Info) 


YORK 


AT NEW YORK CITY 


Denver Division considers this lead covered. Read and 


FBI(19-cv-1495)-353 


FD-515 (Rev. 7-16-02) 


[wig 


Squad supervisor approval 
{please initial} 


@ 


;complishment rust be reported and loaded into SRA 


Accomplishment Report 


within 30 days from date of accomplishment) 


bt 
Date Prepared Qe 6 -1 


-2 


DateLoaded ob 7C -1 


Released by: [] Terrorist (] Other = 


Number of He 


Disruption Date: 


Dismantlement Da 


Completion of FO-S15a Side 2 Mandatory 


°. 
JrmmeChild located/identified Date: 
C2 Living™——),Deceased 


Child Victim Information 


_2-?Subject information - Required for all blocks excluding blogk’D (Recovery/PELP), blocks E, 


ib and N, a 


Data Loader's initiate - - 
‘Accomplishment involves: DIE -3, 8 
{check all that apply) i investigative Assistance or Technique Used 
Drags o +-Used, but did not help 3- Helped, substantially 
m 2-Helped, minimally 4. Absolutely essential 
AFugitive Go an For Sub, Invest, Assist. by other FO {s) indicate A,B,C.D for corresponding FO 
Bankruptey Fraud G St joc. Sec. 
C ter FraudiAbi Sate FO aT Rate FO. aT Rate FO. tar Rata FO. aT 
Compton re of fet , 5 Fin, Analyst _| Lab. Div. Exar co - Groupt . Mon ITC 
‘omuption of Public Officials 
Stat Agent Name i 7 
Money Laundering fat gt Aiccratt Asst. | Lab. Field Sup| uCO - Group Ht ‘or. Lang Asst, 
Sub Invest AsstbyFO(®) O computer | Pen Registers | 1UCO - Nat. Back lon FBI Lab Ex 
Aeros RA | Squad Consen Mon. | Photo Cover. | INCAVG/ VI- Cai fot-Witn Coot 
Sst. FOS), 
AB, GD POYO Dis Eisur / FISC. | Polygraph | Crimi Intel Ass| JO Wanted Flyer 
Tusk Foros Assisting Agents Sos. Sec. No, * Stour | Search waran cisis Neg - Fee! AS 
te Eng, Field Sof Show Money | Crisis Neg, - Lect “ART 
= Eng. Tape Ex] fso@Asst. | ERT Asst. set Fort Prog 
Assisting Agencies x Name: Tegats Asst. [Swat Team Butte - IFC ot Support Pro] 
1. 2. - - Evid Purchas [Tech AgEquip Sav - ITC 
2. Name: InfOW Ino Phone Tol Poo -11¢ 
A. Complaint /{nformation / Indictment F. Conviction J. Civil Rico Matters Date: 
DFederal (4 Local C International DFederal (] Local (J Internationat Aiso Complete “Section @” 
Complaint Date: Conviction Date: Other Civil Matters Date: 
Check if Civil Rico Complaint 0) Sublect Description Code: . Judgment 0 
; . — Judicial Outcome * 
information Date: For 6F, G, H-Include Agency Code Amount $ 
inglotment Date: D Felony or) Misdemeanor Suspension: Years Months 
B. (LocatesArrest D Plea or =D) Trial 
Federal [ Local [1 International State: Judicial District: K, Administrative Sanction Date: 
‘Subject Prior Subject Desetnion Code 
: a 
Locate Date: G. U.S. Code Violation Cr Suspension 1 Permanent aa 
Arrest Date: Required for sections A,8,Fand J 1 Debarment or i 
UD Subject Resisted Arrest {Federal Only) © Injunction Year. Mont 
Cl Subject Arrested was Armed Title Section # Counts = 
iB lise ip30 layiss L. Asset Seizure Date: 
©. Summons Date: usc in9a( gy (a Asset Forfeiture Date: 
DB Federal Local ALL INFORWATION CONTRDNED CATS # Mandatory 
a REIN 1S THIEL: — — Circle below one of the three asset forieiture: 

D. Recovery/Restitution/PELP X SMIE fdeoT-2ait Admin, Civil Judicial, or Criminal . 
C Federal 1) Local Intemational "0" Tere SS Donot indicate $ vatue in Section D bo -1 
Recovery Date: H. Sentence Date: - Cc -1 
Code * v amount § . Senteroe Type: M. Acquittal/Dismissal/Pretrial Diverstor: 
Code * ¥ Amount §. In Jail: Yeats Months (circle one) Date: 

Restitution Date: Suspended: Years, Months ; 

(Court Ordered [Pretrial Diversion Years Months N. Drug Seizures ater, 

Code * ¥ Amount §, $ — Drug Code *, 

PELP Date: Weight Code 

Code *. v Amount $. L. Disruption/Dismanttement: 7 e* Do not indicate $ value in Section D 
E, Hostage(s) Reteased Date: 


Name 


Race * 


Wl 


Sex 


Date of Birth [Social Security No. @f avallagtg) 


ADR Alfonso [Amp 7 


Ww 


ru 


J0)\98)| DY -74- Lek} 


For Indictments/Convietions only: 


(1) “Sipe: 


Complete FD-5%5a, Side 1 Blocks A-E mandatory, F-H as appropriate. 


i 
Come Hiss 


SawSide 1 Blocks A-C only, 


alt Subject related to an LCN, Asian Organized Crime (AOC), Ilatian Organized Crime (100), Russian/Eastern European, Caribbean, or Nigerian Organized Crime Grgtip - 


ated to an OG/Drug Organization, a VCMO Program National Gang Strategy targel group, or a VCMO Program National Priority Initiative target gs a 


x 


Additional information may be added by attaching, another form or a plain sheet of paper tor adaiional erties. 


See codes on reverse side. 


a 


les"SEridl_No. of FD-515 


Requires that an explanation be attached and loaded into ISFAA for recovery over $1m and PELP over 85, disruption, dismantiement, and drug seizures. 
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DATE o 
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U.S. Department of Justice bTC 


Federal Bureau of Investigation 


In Reply, Please Refer to 26 Federal Plaza 
File No. New York, New York 10278 
September 19, 2003 


b6 -5 
b7c -5 
To whom it may concern: 


Pursuant to Title 18, United States Code, Section 
2703(f) you are hereby directed to take all steps necessary to 
preserve all records and other evidence in the possession of 

Such records and evidence 

include, but are not limited to hacker documentary film, notes, 
photographs, files, communications/ E-mail messages, programs, 
client account records and files, fand any other documents: worked 
on, reviewed by, aratted bp: <edived By, examined by, received by, 
sent to or pertaining to{adria Lamo. 


This request is madé in anticipation of an appropriate 
Order requiring the production of all information (including 
content) pursuant to the Electronic Communication Transactional 
Records Act, 18 U.S.C. § 2701, et seq. Under Section 2703(f), 
you are required to preserve these items for a period of 90 days. 
This period is subject to renewal. 


Please be advised that your failure to comply with this 
request may subject you to criminal penalties, including, but not 
limited to, obstruction of justice under 18 U.S.C. § 1503, et 
seq. 


Because this request in being made pursuant to an 
official criminal investigation, you are requested not to 
disclose this request, or its contents to anyone. 


ght o 9 Ut. 


GEOL AT 
oe 


FBI(19-cv-1495)-357 


If you have any questions or need_additional 
information, please contact Special Agent at 
telephone (212) 384-1000, fax (212) 384-4600. 


Sincerely, 


Pasquale J. Damuro 
Assistant Director in Charge 
New York Office 


By: 


Supervisory Special Agent 


FBI(19-cv-1495)-358 


UPLOADED 


wth :b6 -1, -5 

WITHOUTTEXT, oe. 
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bare, SEP 29 200y 


FBI(19-cv-1495)-35 
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U.S. Department of Justice be 


b7C 


Federal Bureau of Investigation 


In Reply, Please Refer to 26 Federal Plaza 
File No. New York, New York 10278 
September 19, 2003 


b6 -5 
bic =5 


To whom it may concern: 


Pursuant to Title 18, United States Code, Section 
2703(£) you are hereby directed to take all steps necessary to 


ceserve all records and other evidence in the possession oi 
Such reco. 


and evidence include, but are not limited to hacker documentary 
film, notes, photographs, files, communications, E-mail messages, 
programs, client account records and files, and any other # 
documents: worked on, reviewed by, drafted by, editedby,/ 
examined by, received by, sent to or pertaining to Adrian Lamo. 


This request is made in anticipation of an”appropriate 
Order requiring the production of all information (including 
content) pursuant to the Electronic Communication Transactional 
Records Act, 18 U.S.C. § 2701, et seq. Under Section 2703(f), 
you are required to preserve these items for a period of 90 days. 
This period is subject to renewal. 


Please be advised that your failure to comply with this 
request may subject you to criminal penalties, including, but not 
limited to, obstruction of justice under 18 U.S.C. § 1503, et 
seq. 


Because this request in being made pursuant to an 


official criminal investigation, you are requested not to 
disclose this request, or its contents to anyone. 


PLM dL Kb 


MbTOVDED 


FBI(19-cv-1495)-360 


If you have any questions or need_additional 
information, please contact Special Agent at 
telephone (212) 384-1000, fax (212)384-460U- 


Sincerely, 


bé -1 
b7C -1 
Pasquale J. Damuro 
Assistant Director in Charge 
New York Office 


Supervisory Special Agen 


FBI(19-cv-1495)-361 


ee 


UPLOADED 
WITH/TEXT. 
WITHOUT TEXT. 
ay 


DATE.” Sep 99. 2em9 


ALL INFORMATICN 


EREIN IS UNCLASSE 
DATE $2-27-2010 Ul BAW, DK /RYS 


P19 enn 


aw HEN YO? é 


FBI(19-cv-1495)-362 


ALL INFS. 
REREIN I. 


U.S. Department of Justice bic -1 


Federal Bureau of Investigation 


In Reply, Please Refer to 26 Federal Plaza 
File No. New York, New York 10278 
September 19, 2003 


b6 
b7C 


To whom it may concern: 


Pursuant to Title 18, United States Code, Section 
2703(f} you are hereby directed to take all steps necessary to 


reserve all records and other evidence in the possession of lL] 
———eeeees Such records and evidence include, 
but are not limited to hacker documentary film, notes, 
photographs, files, communications, E-mail messages, programs, 
client account records and files, and any other documents: worked 


on, reviewed by, drafted ey7 ex oo BY examined by, received by, 


sent to or pertaining a 


This request is made in anticipation of an appropriate 
Order requiring the production of all information (including 
content) pursuant to the Electronic Communication Transactional 
Records Act, 18 U.S.C. § 2701, et seq. Under Section 2703(f), 
you are required to preserve these items for a period of 90 days. 
This period is subject to renewal. 


Please be advised that your failure to comply with this 
request may subject you to criminal penalties, including, but not 
limited to, obstruction of justice under 18 U.S.C. § 1503, et 
seq. 


Because this request in being made pursuant to an 
official criminal investigation, you are requested not to 
disclose this request, or its contents to anyone. 


$8 


FBI(19-cv-1495)-363 


If you have any questions or need_ additional 
information, please contact Special Agent at 
telephone (212) 384-1000, fax (212) 384-4660. 


Sincerely, 


Pasquale J. Damuro 
Assistant Director in Charge 
New York Office 


By: 


Supervisory Special Agent 


FBI(19-cv-1495)-364 


Pat 


UPLOADED . : 

WITHITEXT. © san 

ae Qpic ~1, -5 
DATE, 


F FBI(19-cv-1495)-365 


U.S. Department of Justice b7c -1 


Federal Bureau of Investigation 


In Reply, Please Refer to 26 Pederal Plaza 
File No. New York, New York 10278 
September 19, 2003 


eer EF TET MET . p7e -5 
To whom it may concern: 


Pursuant to Title 18, United States Code, Section 
2703(f£) you are hereby directed to take all steps necessary to 


reserve all records and other evidence in the possession of[__—i 
Such records and evidence 
include, but are no imite © hacker documentary film, notes, 


photographs, files, communications, E-mail messages, programs, 
client account records and files, _and-any other documents: worked 
on, reviewed by, drafted by,.editéd by, examined by, received by, 
sent to or pertaining to Adrian/Lamo<” 


This request is madé in anticipation of an appropriate 
Order requiring the production of all information (including 
content) pursuant to the Electronic Communication Transactional 
Records Act, 18 U.S.C. § 2701, et seq. Under Section 2703(f) 
you are required to preserve these items for a period of 90 days. 
This period is subject to renewal. 


Please be advised that your failure to comply with this 
request may subject you to criminal penalties, including, but not 
limited to, obstruction of justice under 18 U.S.C. § 1503, et 
seq. 


Because this request in being made pursuant to an 
official criminal investigation, you are requested not to 
disclose this request, or its contents to anyone. 


FBI(19-cv-1495)-366 


If you have any questions or need additional 
information, please contact Special Agent at 
telephone (212) 384-1000, fax (212)384-4600- 


Sincerely, b6 -1 
b7c -1 


Pasquale J. Damuro 
Assistant Director in Charge 
New York Office 


FBI(19-cv-1495)-367 


0% 
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U.S. Department of Justice 


Federal Bureau of Investigation 


In Reply, Please Refer to 26 Federal Plaza 
File No. New York, New York 10278 
September 19, 2003 


bo -5, 
DIC ery 
To whom it may concern: \ - 


Pursuant to Title 18, United States Code,: Section 
2703(f) you are hereby directed to take all steps necessary to 
preserve all records and other evidence in the possession of 
Such records and evidence include, but are not 
imite © hacker documentary film, notes, photographs, files, 
communications, E~mail messages, programs, client account records 
yand files, and any By, pfeningt by, worked on, reviewed by, 


drafted by, edi arby, amined ‘by, received by, sent to or 
pertaining to n 


This regquést is made in anticipation of an appropriate 
Order requiring the production of all information (including 
content) pursuant to the Electronic Communication Transactional 
Records Act, 18 U.S.C. § 2701, et seq. Under Section 2703(f), 
you are required to preserve these items for a period of 90 days. 
This period is subject to renewal. 


Please be advised that your failure to comply with this 
request may subject you to criminal penalties, including, but not 
limited to, obstruction of justice under 18 U.S.C. § 1503, et 
seq. 


Because this request in being made pursuant to an 
official criminal investigation, you are requested not to 
disclose this request, or its contents to anyone. 


Pg BP RM nay 


boven 


FBI(19-cv-1495)-369 


If you have any questions or need_additional 
information, please contact Special Agent at 
telephone (212) 384-1000, fax (212)384-4660. 


Sincerely, 


Pasquale J. Damuro 
Assistant Director in Charge 
New York Office 


By: 


Supervisory Special Agent 


: FBI(19-cv-1495)-370 


UPLOADED 
WITHITEXT__, 


waren Tex 
By_ AL 


DATE SEP 9 9 2008 
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® 


e 


U.S. Department of Justice 


Federal Bureau of Investigation 


In Reply, Please Refer to 26 Federal Plaza 
File No. New York, New York 10278 
September 19, 2003 b6 -5 


To whom it may concern: Caer 


Pursuant to Title 18, United States Code, Section 
2703(£) you are hereby directed to take all steps necessary 
reserve all records and other evidence in the possession of] 
a Such records and evidence include, but are not limite 
© hacker documentary film, notes, photographs, files, 
communications, E-mail messages, programs, client account records 
and files, and any other document's: worked on, reviewed by, 


drafted by, ediLed-byf—exa ified by, received by, sent to or 
pertaining tg@_A ‘AdrianLamo. 


This request is made in anticipation of an appropriate 
Order requiring the production of all information (including 
content) pursuant to the Electronic Communication Transactional 
Records Act, 18 U.S.C. § 2701, et seq. Under Section 2703(f), 
you are required to preserve these items for a period of 30 days. 
This period is subject to renewal. 


Please be advised that your failure to comply with this 
request may subject you to criminal penalties, including, but not 
limited to, obstruction of justice under 18 U.S.C. § 1503, et 
seq. 


Because this request in being made pursuant to an 
official criminal investigation, you are requested not to 
disclose this request, or its contents to anyone. 


TEE 3 8 Seng 


2 senate 
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FBI(19-cv-1495)-372 


If you have any questions or need additional 
information, please contact Special Agent lat 
telephone (212) 384-1000, fax (212)384-4660. 


Sincerely, b6 -1 
b7c -1 


Pasquale J. Damuro 
Assistant Director in Charge 
New York Office 


By: 


Supervisory — =" 


FBI(19-cv-1495)-373 


UPLOADED wile AZ. 50. 
WITHITEXT. a oe 
WITHIQUTJTEXT. “1, -S wig) SEP 1 > 2003 
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pave SEP 23 2008 
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U.S. Department of Justice 


Federal Bureau of Investigation 


In Reply, Please Refer to 26 Federal Plaza 
File No. New York, New York 10278 
September 19, 2003 


bé -5 
b7C -5 


To whom it may concern: 


Pursuant to Title 18, United States Code, Section 
2703(f£) you are hereby directed to take all steps necessary to 


reserve all records and other evidence in the possession of 
a Such records and evidence include, but are not 
imite © hackér documentary film, notes, photographs, files, 


communications, E-mail messages, programs, client account records 


sSt is made in anticipation of an appropriate 
Order requiring the production of all information (including 
content) pursuant to the Electronic Communication Transactional 
Records Act, 18 U.S.C. § 2701, et seg. Under Section 2703(f), 
you are required to preserve these items for a period of 90 days. 
This period is subject to renewal. 


Please be advised that your failure to comply with this 
request may subject you to criminal penalties, including, but not 
limited to, obstruction of justice under 18 U.S.C. § 1503, et 
seq. 


Because this request in being made pursuant to an 
official criminal investigation, you are requested not to 
disclose this request, or its contents to anyone. 


PS Be 8d 68 


TUL OT ey 
ARAHALER LO 
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If you have any questions or need_additional 
information, please contact Special Agent at 
telephone (212) 384-1000, fax (212)384-4660. 


Sincerely, b7c -1 


Pasquale J. Damuro 
Assistant Director in Charge 
New York Office 


By: 


Supervisory Special Agent 


FBI(19-cv-1495)-376 
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o ° 


U.S. Department of Justice 


Federal Bureau of Investigation 


In Reply, Please Refer to 26 Federal Plaza 
File No. New York, New York 10278 
September 19, 2003 


b6 
bIC 


To whom it may concern: 


Pursuant to Title 18, United States Code, Section 
2703(f£f) you are hereby directed to take all steps necessary to 
reserve all recor nd other evidence in the possession of 
Such records and evidence include, but 
are not limited to hacker documentary film, notes, photographs, 
files, communications, E-mail messages, programs, client account 
records and files, andy any other documents: worked on, reviewed 
by, drafted by, edited-by;~examined by, received by, sent to or 


pertaining (aa ed 
This réquest is made in anticipation of an appropriate 


Order requiring the production of all information (including 
content) pursuant to the Electronic Communication Transactional 
Records Act, 18 U.S.C. § 2701, et seq. Under Section 2703(f), 
you are required to preserve these items for a period of 90 days. 
This period is subject to renewal. 


Please be advised that your failure to comply with this 
request may subject you to criminal penalties, including, but not 
limited to, obstruction of justice under 18 U.S.C. § 1503, et 
seq. 


Because this request in being made pursuant to an 


official criminal investigation, you are requested not to 
disclose this request, or its contents to anyone. 


FBI(19-cv-1495)-378 


telephone 


(212) 384-1000, 


If you have any questions or need_additional 
information, please contact Special Agent at 


fax (212) 384-4600- 


Sincerely, b6 -1 
b7C -1 


Pasquale J. Damuro 
Assistant Director in Charge 
New York Office 


By: 


Supervisory — Agent 


FBI(19-cv-1495)-379 
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U.S. Department of Justice 
Federal Bureau of Investigation 

In Reply, Please Refer to 26 Federal Plaza 

File Ne: New York, New York 10278 
September 19, 2003 

== b6 -5 
To whom it may concern: b7C -5 


Pursuant to Title 18, United States Code, Section 
2703(£} you are hereby directed to take all steps necessary to 
ha rve_ all records and other evidence in the possession of 
Cer), sch records and 
evidence include, but are no imite o hacker documentary film, 
notes, photographs, files, communications, E-mail messages, 
programs, client account records and files, and any other 


documents: worked on, reviewed by, drafted by, edited-by; 
examined by, received by, sent to or pertaining €o Adrian/Lamo. 
— 


This request is made in anticipation of an a 
Order requiring the production of all information (including 
content) pursuant to the Electronic Communication Transactional 
Records Act, 18 U.S.C. § 2701, et seq. Under Section 2703(f), 
you are required to preserve these items for a period of 90 days. 
This period is subject to renewal. 


Please be advised that your failure to comply with this 
request may subject you to criminal penalties, including, but not 
limited to, obstruction of justice under 18 U.S.C. § 1503, et 
seq. 


Because this request in being made pursuant to an 


official criminal investigation, you are requested not to 
disclose this request, or its contents to anyone. 
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Record Request 
FO-125 (Rev. 4-4-93) 


Other 


Birth Credit Bf crininat Death INS: Marriage* Motor Vehicle 


Buded 


Name and aliases gf-sdBject, applicant, or employZé, and spouse 


ZRRIPN LED 
foooee 1155 BA BAMA St, Sn Farin, Ch 


Business 
, 


“ 
Forme? _ 


OO = all 


Date ond place of marriage 
GF applicable 


Race Sex Age Height Weight Hair - {Eyes 
fale 
Female 
Birth date Birthplace 
Arrest Number Fingerprint classification Criminal specialty 
Socfat Security Number Drivers License Number 


O44”? ~ TY- lo SOY O/L Photo other 


Specific information desired 


Results of check 
Cot 
b6 -1 
b7c -1 Vil 
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bo -1 
bz. 41 


_KFRD HIN@ DCIS 
Oi489 “FILE 15 TYPE 1 NAE SEARCH TO DOJS “AND NCIC) PUR/C &F 
- OPERATOR/. LOS/KFBD. CONFIDENTIAL LOG/ 

| .PUR/C. REASON/CRI. ORT/NYFBINYES, CASES, 

»NAM/LANO, ADRIAN «SEX/M, RAC/L, DOB/DRBaRD 

'SKIN TONE/*.HGT/® , SOC/a42746804, FBI/# ~ BIN? 

sALTASHL /# ? 

-ALIASEE/# 

-PALIASHZ/# S . 

~ALIAS#A/# : E - 3 -2 

- ALIASES /# . yo : bIE -3 


» REQUESTOR? S ANE Sol : “b6 L 
» COMMENTS. COMPUTER INTRUSION-CRIMINAL MATTERS, ee tee 1 


E 2056-21 56 03/6/02 ROSS KFBD i1157 RDS QAiGO7ER FART Gi OF gai 
NYSP HING KFBD 
INPUT SEQUENCE NUMBER @1429 HAS BEEN CORRECTED TO @1443 


SWS6-2U56 B3/B6/Ge ROSHF KFBD 11158 RDSGH @aiae728 FART 201 OF aa 
NYSE HING DCJS KFBD 2856 
FORWARDED TO DCJS ONLY 


OS6~i 2058 @3/06/0 ROSDH KFBD 11159 RDSGH BALAV7SR PART Bi oF ant 
NYSP 'PTST KFBD 2056 : 


NYFBINYES 
,NO RECORD - NYSPIN WANTED PERSDNS FILE : , 
NAM/LAMO, ADRIAN ; - Eats 


*, SEX/M. RAC/U 


NOTE:YOUR INQUIRY WAS PROCESSED BY NYSPIN ONLY 
INSUFFICIENT DATA ENTERED FOR DCJS OR NCIC SEARCH 


NM 2OS6-2056 82/06/02 ROSHH KFRD 11162 RDSOE MO198734 “FART Oa OF ant 
NYSP FARG KFAD 2856 

NYFBINYES “= * : ror 
NO RECORD — NYSPIN PAROLE FILE : eS a a ie 
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OCT 9 9 2002 bIC -1 


FBI — he hin 


FBI(19-cv-1495)-579 


10/09/2002 b6 -1 
CAH:cah b7c -1 
An ACS re conducted into the following names. Thenames D7E -2 
were obtained through subscriber records for telephone calls placed to them by ADRIAN LAMO._ 
1. Results negative 
address: Mt. View, CA 
telephone number: 
SSN: 
DOB: 
2. Results negative b6 -3 
address: Veradale, WA 99037 e a es 
old address: Houston, TX 77014 
SSN: 
DOB: 
owns: Discount Voicemail Company 
3 
San Francisco, CA 
San Francisco, CA 
ults negative 
Burlingame, CA 94010 
5. Results negative 
ad B Poterville, CA b6 -3 
tel : bIG -3. 
6. Results negative 
ad Carmichael, CA 
tel 
Ts Results negative 
address: Rancho Cordova, CA 95742 
b3 -2 FBI(19-cv-1495)-580 


bs 


eo e 


other address: 
telephone: 


Fair Oaks, CA 


San Francisco, CA . 
b6é -3 
b7Cc -3 


3 Results negative 
address: [West Sacramento, CA 
telephone: 
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If you have any questions or need_additional 


information, please contact Special Agent at 
telephone | fax (212) 384-4660. 


Sincerely, 


b6é -1 
b7C -1 


Pasquale J. Damuro 
Assistant Director in Charge 
New York Office 


By: 


Supervisory Special Agent 
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| |? Gn o” 
2 6 -5 
b7c -5 
UPLOADED 


WITH/TEXT. 
Wi 


wAQ) SEP 1 9 2005 


3] — NEW YORK 
1 
SP 34 


i ete ee 
pare 50? 23 


ALL INFORM 


bol 
b7c -1 


® FBI(19-cv-1495)-38 
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U.S. Department of Justice 


Federal Bureau of Investigation 


In Reply, Please Refer to 


File N 26 Federal Plaza 
ile No. 


New York, New York 10278 
September 19, 2003 


To whom it may concern: 


. Pursuant to Title 18, United States Code, Section 
2703({f) you are hereby directed to take all steps necessary to 


reserve all records and other evidence in the possession of 
Such records and evidence 
include, but are no imited to hacker documentary film, notes, 


photographs, files, communications, E-mail messages, programs, 
client account records and files, and any other documents: worked 
on, reviewed by, drafted by, edited by, examined by, received by, 


sent to or pertaining oe 
This request is mad@é in anticipation of an appropriate 


Order requiring the production of all information (including 
content) pursuant to the Electronic Communication Transactional 
Records Act, 18 U.S.C. § 2701, et seq. Under Section 2703(£), 
you are required to preserve these items for a period of 90 days. 
This period is subject to renewal. 


Please be advised that your failure to comply with this 
request may subject you to criminal penalties, including, but not 
limited to, obstruction of justice under 18 U.S.C. § 1503, et 
seq. 


Because this request in being made pursuant to an 
official criminal investigation, you are requested not to 
disclose this request, or its contents to anyone. 


FBI(19-cv-1495)-384 


If you have any questions or need_additional 


information, please contact Special Agent[S—Csdtctt 
telephone Poo tax (212) 384-4660, 


Sincerely, 
bo -1 
b7c -1 


Pasquale J. Damuro 
Assistant Director in Charge 
New York Office 


By: 


Supervisory — Agent 


FBI(19-cv-1495)-384 
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, e 


TISN TONTRINED ® 
ur AGIPIES 


bo -1 
U.S. Department of Justice bre eT 


Federal Bureau of Investigation 


In Reply, Please Refer to 26 Federal Plaza 
File No. New York, New York 10278 
September 19, 2003 


b6 -5 Ci. > 
DIC -5 _— é 


Pursuant to Title 18, United States Code, Section 
2703(£} you are hereby directed to take all steps necessary to 
reserve all records and other evidence in the possession of 
Such records and evidence 
include, but are not limited to hacker documentary film, notes, 
photographs, files, communications, E-mail messages, programs, 
client account records and files, and any other documents: worked 
on, reviewed by, drafted b edited.b , examined by, received by, 
sent to or pertaining to Adrigh Lamo. JU 


, To whom it may concern: 


This request is made in anticipation of an appropriate 
Order requiring the production of all information (including 
content) pursuant to the Electronic Communication Transactional 
Records Act, 18 U.S.C. § 2701, et seq. Under Section 2703(f), 
you are required to preserve these items for a period of 90 days. 
This period is subject to renewal. 


Please be advised that your failure to comply with this 
request may subject you to criminal penalties, including, but not 
limited to, obstruction of justice under 18 U.S.c. § 1503, et 
seq. 


Because this request in being made pursuant to an 
official criminal investigation, you are requested not to 
Gisclose this request, or its contents to anyone. 


ee 328 
vas 
Nalis OCU PERE 


PALNUEKL 
MbFOVBED 


recov tepatte 


FBI(19-cv-1495)-387 


information. 
telephone 


If you have any questions or ne itional 
lease contact Special Agent at 
fax (212) 384-466007 


Sincerely, 


be -1 
b7c -1 


Pasquale J. Damuro 
Assistant Director in Charge 
New York Office 


By: 


Supervisory Special Agent 


FBI(19-cv-1495)-388 


. b6 -5 _e 


UPLOADED 
WITHTEXT. 
WITH/OUT TEXT. 


py_ Gave 
DATE___‘SEP 23 2004 
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CL} BAN/DEYRYS bo -1 


b7c -1 
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TATE 22- 
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TAINED 
ZL 


U.S. Department of Justice 


TATE 02 


Federal Bureau of Investigation 


In Reply, Please Refer to 26 Federal Plaza 
File No. New York, New York 10278 
September 19, 2003 


a 


To whom it may concern: 


Pursuant to Title 18, United States Code, Section 
2703(£) you are hereby directed to take all steps necessary to 


reserve all records and other evidence in the possession of 
ee Such records and evidence include, 

ut are no imite © hacker documentary film, notes, 
photographs, files, communications, E-mail messages, programs, 


client account records and files y and any--other documents: worked 


on, reviewed by, drafted, examined by, received by, 
sent to or pertaining eR ie 


This request is made in anticipation of an appropriate 
Order requiring the production of all information (including 
content) pursuant to the Electronic Communication Transactional 
Records Act, 18 U.S.C. § 2701, et seq. Under Section 2703(f}, 
you are required to preserve these items for a period of 90 days. 
This period is subject to renewal. 


Please be advised that your failure to comply with this 
request may subject you to criminal penalties, including, but not 
limited to, obstruction of justice under 18 U.S.C. § 1503, et 
seq. 


Because this request in being made pursuant to an 
official criminal investigation, you are requested not to 
disclose this request, or its contents to anyone. 


ae 
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FBI(19-cv-1495)-390 


If you have any questions or need additional 


ct Special Agent at 
(212) 384-46007 


informatio. 


— 


Sincerely, 
be -1 
b7c -1 


Pasquale J. Damuro 
Assistant Director in Charge 
New York Office 


By: 


Supervisory Special Agent 
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FEDERAL BUREAU OF INVESTIGATION 


Date of transcription _09/22/2003 
e, born on[___ | Social 


was interviewed at his place b6 -2 


Security Account_number| 
of residence, 
After being advised of the official identities of the interviewing 
agente | provided the following information: 


was unable to identify ADRIAN LAMO, from a 
photograph that was presented to him. When asked, be -2 
advised that he has never heard of LAMO or any of his computer BIC 8 
intrusion activities. Additionally,[_Ja@vised that his 
knowledge is very limited regarding computers. 


CL Jhas a Lexis Nexus account at work. 


is unaware if an unauthorized person_used hi ogin and passwordhsg -2, -5 
information to access Lexis Nexus. commented that henge eve 
jhe 


keeps his Lexis Nexus password written on a piece of paper taped ~{C 
his computer. Furthermore, eee TA access to his 
computer _on weekends and during other miscellaneous times; however, 
have their own accounts with Lexis Nexus.[ | 
telephone number is responsible for 
computer security in joffice. 


iends that have a connection to ie 
residing is e 
ig currently employed by Lexis Meb7C 
was formerly employed by the 


Lexis Nexus. 


telephone number 
: | a rec 


company - = = . 
iscmarriedsto [22 = eh, The 
nave a computer in their home and AMERICA ONLINE (AOL). 
is their Internet Service Provider. does not know the D6 


Internet Protocol address for either his work or his_home computer. b7C -2 


Investigatic 


This document contains neither recommendations no. ve. 


Colorado Springs, CO 
b3 -2 
DIE -3 Date dictated 


FBI(19-cv-1495)-392 


of the FBI. It is the property of the FBI and is loaned to your agency; 


it and its contents are not to be distributed outside your agency. 


eo «x 
ae @ 6 


bIE -3 


omimsinstroant [| yo 09/28/2003 ogg 2 
| reported the 


problem to AOL and she was instructed to open a new e-mail account. 
In addition to AOL, the[ —S—C J have: used) Yahoo Instant D6 -2 
Messenger, MSN, and nocharge.com for e-mail services. Be 


FBI(19-cv-1495)-393 
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Rev. 01-31-2003) 


bé -1 
b7c -1 


Precedence: ROUTINE Date: 09/19/2003 
To: pe York Attn: SA 
Squad DT-5 
From: Denver va 
CSRA/SQ 12 
Contact: be -1 
b7C -1 


Approved By: [7 BU 
Drafted By: 
Case ID #; b3 -2 


Title: ADRIAN LAMO; BIE -3 


New York Times-Victim; 
Computer Intrusion; 
OO: NY 


Synopsis: To report interview off on 09/18/2003, Pea 5 
DIE -3 


Enclosure(s): Enclosed for New York are two (2) copies of the 
FD302 regarding the interview of [TT CCC*d =m: 09/18/2003 VP 
and the corresponding FD340 envelope containing interview notes 
and a photograph of Adrian Lamo utilized during the interview.b6 -l, -2 


b7c -1, -2 
09/18/2003,[__ | Dos 


SSAN 
residence, 
by Special Agents 


telephone_number 
of the Colorado Springs Resident Agency, Denver Division. 


and 


Inasmuch as all lead requests were addressed, Denver 
considers this lead covered. 


FBI(19-cv-1495)-394 


\ 


To: New York From: Denver 


LEAD (s): 
Set Lead 1: (Info) 
NEW YORK 
AT _ NEW YORK CITY 


Denver Division considers this lead covered. Read and 
clear. : 


+ 


FBI(19-cv-1495)-395 


ge | 


FD-302 (Rev. £0-6-95) 


FEDERAL BUREAU OF INVESTIGATION 


Date of transcription _09/23/2003 


social security account_number 
was interviewed at his place of business; 


resides at 
After being advised of the identity of the interviewing 
agents and the nature of the interview, [fe 7 peowicen the b6 
following information: b7 


[____Jouns 


which opera 


has not heard of 
ADRIAN LAMO and does not recall ever meeting or speaking with him. 

did not recognize LAMO when shown a photograph, and the 
customer database he maintains does not contain a record of anyone 
with the name LAMO having used 


retains a bank of pre-paid cellular phones for 
customer use while He does not 


maintain cellular phone call records used with the particular 
a= and could_not produce records to confirm 
whether or not the phone ndber [ee ee assigned to one 


of his cellular phones during the year 2002. 


Investigation on (09/23/2003 a Alexandria, Virginia b3 =2 
-3 

File Date dictated 09/23/2003 

by SA FBI(19-cv-1495)-396 


‘This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; 
it and its contents are not to be distributed outside your agency. 


-6 
E60 


be -1 
baCr St 


FID-302 (Rev. 10-6-95) . 
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FEDERAL BUREAU OF INVESTIGATION 


Date of transcription _ 09/24/2003 
born | social security 


was interviewed at his place of 


account mumbex 


residence, | 

phone number, After being advised of the b3 -1 
identity of the interviewing agents and being served a Federal b6 -3 
Grand Jury Subpoena from the Southern District of New York, ID7C -3 


provided the following information: 


- 


Investigation_o: Alexandria, Virginia 


b3 -2 

DIE -3 Date dictated 09/24/2003 | 
b6 -1 FBI(19-cv-1495)-397 : 
bIC -1 


This document contains neither recommendations nor conclusions of the FBI. it is the property of the FBI and is loaned to your agency; 
it and its contents are not to be distributed outside your agency. 


+ BD-302a (Rev. 10-6-95) 


bs. =1 
Continuation of FD-302 of ,On 09/23/2003 _,Page 2 6 3 
bi Cus 


FBI(19-cv-1495)-398 


United States District Court 


SOUTHERN DISTRICT OF NEW YORK. 


Grand Jury Subpoena 0108 


TO: EON CONTAINED: 
; ba aL 
ORL ge S8 
b7¢ -1, 3 
GREETINGS: 


WE COMMAND YOU that all and singular business and excuses being laid aside, you appear and attend 
before the GRAND JURY of the people of the United States for the Southern District of New York, at the 
United States Courthouse, Foley Square (40 Centre Street), Room 209, in the Borough of Manhattan, City 
of New York, New York, in the Southem District of New York, at the following date, time and place: 


Appearance Date: [| * Appearance Time: [| b3 -1 


to testify and give evidence in regard to an alleged violation of : 


Title 18, United States Code, Section 1030 


and not to depart the Grand Jury without leave thereof, or of the United States Attomey, and that you bring 
with you and produce at the above time and place the following: 


SEE ATTACHED RIDER 
NB: PERSONAL APPEARANCE IS REQUIRED. Please produce the requested documents on : 
or before the return date to Special Agen ‘ederal Bureau of Investigation, be -1 
26 Federal Plaza, New York, New York 10278, telephone co a b7c -1 
mumber (212) 384-4660. 


Failure to attend and produce any items hereby demanded will constitute contempt of court and will subject ° 
you to civil sanctions and criminal penalties, in addition to other penalties of the Law. 


DATED:__New York, New York 


JAMES B. COMEY A. boy JY a C “ 


United States Attorney for the 


Southern District of New York 0. WMicllaal Ww, Mall.> : 


Assistant United States Attorney Telephone: 
One St. Andrew’s Plaza : (212) 637-2487 
New York, New York 10007 


FBI(19-cv-1495)-399 


arn * Frcs Crvech , VA 
SERVED 

. b3 -1 
seevedoss[ boat 


Setven bY - st FBI SPECIAL A6ENT 


DECLA ATION oF SERVEVL 


1 Péclace uNpee petty oF fek vey Under wits. LAWS of THE 
UNITED STATES of menue THAT THE FHeEGO SG rolEoemarre a) 
Contin) iw Tire Pheok- 9€ SERUCE 1S TRUE AnD CoreecT 


b3 -1 
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FD-302 Rev. 16-6.95) 


FEDERAL BUREAU OF INVESTIGATION 


Date of transcription _09/25/2003 


On. September 24, 


2003, social securit 
account number 


residing at 


nhonically contacted Special Agent (SA 
is the owner of 
business telephone 
stated that upon doing further research, he had 
found documentation in the Do business files indicating 


the cellular telephone numbers that were carried b 


h to be re-interviewed by SA in person, 
at the office at 


During the interview, [ __] provided SA 
documents indicating that _a cellular One with number 
during the period that 

on September 28 and 29, 2002. stated that four 
clients were on September 28 and 29, 2002, 
and provided usiness records in Teatingh 


Included in the attached 1A envelope are the records 
provided to SA LL |by . 


b6 -l, -3, -6 
b7C -l, -3, -6 


b3 -2 
Investigation on__—«aO0.9/24/2003 at Alexandria, Virginia bIE -3 
File # Date dictated 09/25/2003 
by if FBI(19-cv-1495)-402 be -1 
b7C -1 


This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; 
it and its contents are not to be distributed outside your agency. 
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bIC -1 
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b7C -1 


(Rev. 01-31-2003) 


Precedence: ROUTINE Date: 09/16/2003 
To: New York 


From: New York 
Squad DT~-5 


contacts sa [————] 


bic -1 


Drafted By: [[__ sl f 


Title: ADRIAN LAMO; DIE 3 
New York Times-Victim; 
Computer Intrusion; 
OO: NY 


Synopsis: Request reimbursement for expense associated with 
above mentioned investigation. 


Details: On August 1-3, 2003, writer received assistance from 
the Las Vegas Division in the above mentioned investigation. SA 

from the Las Vegas Division assisted in locating and p6 -1 
attempting to apprehend the subject of the investigation who b7c -1 
allegedly was attending DEFCON 11 from August 1-3, 


Writer requests reimbursement for the [] 


had 


_ b6 -1 
DAE Bib Seine BIC -1 
AAULMIONLIEY LD OT * 

LRLERLEY pone 
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FD-302 (Rev. 10-6-95) 


bé -1 
b7c -1 
FEDERAL BUREAU OF INVESTIGATION 
Date of transcription 9/23/2003 
An individual who is not in a position to testify b6 -1 


provided the following information to SA[7____—scon ¥ 
September 23, 2003: b7C -1 


According to records, 

Social Security Account Number is associated with the name 

— The following entities have reported wages for 
bé -5 


biG 5 
1. 
telephone number during the 
st quarter o thru the 2nd quarter of 2003. : @) 


2: 


telephone number during the 
ist and 2nd quarter of 2003. 


telephone number during the 2nd quarter of 
2003. 


Social Security Account Number 454-51-0098 is associated with the 
name A. Lamo. During the first quarter of 2002, Lamo was employed by 
The Talbots. (The Frick Co., P.O. Box 283, St. Louis, MO, 63166, 
telephone number 781-749-7600 handles reporting to the TXWC for The 
Talbots) No further information for The Talbots is available. 


b6é -1 
b7c -1 
b3 -2 
b7E -3 


Investigation on 


09/23/03 


Telephonically 


ae bé -1 
te dictated 9/23/03 b7C -1 
FBI(F9-cv-1495)-405 DID —2 

: b3 -2 
b7E -3 


File # 


‘This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is Joaned to your agency; 
it and its contents are not to be distributed outside your agency. 
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CRITE 


FEDERAL BUREAU OF INVESTIGATION 


Date of transcription o9 /3 ie] {2 003 


current address: 
telephone 


was advised of the identity of the 
interviewing agents, and that the interview concerned Adrian Lamo. 
provided the following information: 


is married to a LAMO and they ae 
reside in California. They have a D 


ADMINISTRATIVE 


At this _ the interview is terminated due tol sid. 


Investigation on 9/29/2003 at Middletown, RI | 


b3 -2 | 
bé -1 : 


by SA SA b7Cc -1 
2BGREO |S OD. 
This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; 
it and its contents are not to be distributed ovtside your agency, 
FBI(19-cv-1495)-406 


BRW/TKSRY. 


ta 


(Rev. 01-31-2003) 


FEDERAL BUREAU OF INVESTIGATION b7C -1 


Precedence: ROUTINE Date: 09/30/2003 


To: New York Attn: DT-5 


sa) 
From: Boston 
P-1/Providence bé -1 
Contact: SA G. oo 


b7c -1 
approved ay: {J 
Drafted By: DED 
Case ID #: teeming )>3 -2 
bIE -3 

Title: ADRIAN LAMO; on 

New York Times-Victim; 

Computer Intrusion; bat 

OO :NY 
Synopsis: Lead for interview off SSSCSC=éid Covered. 
Enclosure(s): Enclosed for New York are two copies of FD-302 of 
interview of be -5 


Details: | ee interviewed on 9/29/2003. bic -S 


, now attending 


Information regarding 

current address: 

current telephone number: 

provided to SA télephonically. 


This lead is considered covered. 


” b3 -2 
DIE -3 
bé -1 
bIC -1 
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FD-302 (Rev. 10-6-95) 


FEDERAL BUREAU OF INVESTIGATION 


Date of transcription _09/15/2003 


ite female, date of birth 

telephone number was 
telephonically contacted. After being advised of the ee 
the interviewing Agent and the purpose of the inquiry, 


voluntarily furnished the following information: bo -5 


: b7C -5 
Telephone number belongs tol and 
her husband, and is e@ telephone number at their 
residence. The ave had this telephone number since 


approximately 1997, when they purchased their residence. 


is the [ana 
urrently resides with them 

sly, resided at an 

with several friends. 
and_ his friends had telephone service at their 
could not recall the number. 

did not know whose name the service was in. \, 


apartment at 


has never heard of ADRIAN LAMO and had 
no idea why LAMO would have called_her and her husband's telephone id 
number. has never heard discuss LAMOpD6G -5 
or anyone involved in computer hacking. nd her 


+ Le 
husband do not own a home computer nor doesf isd BIC ~S 


reiterated that she has never heard of 
LAMO and ‘had no idea why he would have co: 
number. 


b3 -2 ; gang 
bIE -3 i oun 
b6 -1 oy 


p7C -1 7 


Ecument 
OK to Upic. 
WUptssdedt 


= vane 


ictoria, Texas {telephonically} 


b3 -2 

Date dictated 09/15/2003 bIE -3 
bé -l | 
FBI(19-cv-1495)-408 pIC 1! 


This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; 
it and its contents are not to be distributed outside your agency. 


rf si‘édA See pee, 


INFORMATICS TAINED 
IED 


FD-302 Rev. 10-6-95) 


FEDERAL BUREAU OF INVESTIGATION 


Date of transcription 09/15/2003, 


date of birth 
telephone number 

was telephonically contacted. After being advised of the 
of the interviewing Agent and the purpose of the inquiry, 
voluntarily furnished the following information: b6 -5 


identified’ as bic -5 
belonging To his parents, and stated 
that it is the telephone number for their residence. Lo dhas 


never heard of ADRIAN LAMO and has no idea why LAMO would have 
called this telephone number. 


, 


xresided at an apartment at 

from approximately January through September _of 

apartment with his girlfriend, 

The apartment 

o enlist in the military. 

a elephone service at the apartment, but mostly used bé -5 
-5 


cellular_tele es. [[_—sidithought that the telephone service 
was in ame, but he could not recall thi elephone b7c -5 
number. had never heard discuss LAMO or 


anyone involved in computer hacking- 


Investigation on 09/15/2003 4 Victoria, Texas (telephonically) 
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FD-302 Rev, 10-6-95) bo -1 
BIC 1, 


FEDERAL BUREAU OF INVESTIGATION 


Date of transcription 09/17/2003 


was interviewed 
i the FEDERAL BUREAU OF INVESTIGATION 
ee accompanied by his mother, After 
being advised of the identity of the interviewing Agent and the 
purpose of the diterview: [=== voluntarily furnished the . 
following information: be -5 
BIC 5 


denied knowing ADRIAN LAMO. CJ was shown 
a photograph of LAMO and again denied knowing him. Other then 
telemarketing Gallego | could not recall receiving any 
— calls at his parents residence from unknown individuals. 


stated _that he only knows a few individuals who reside 
outside of thel and none of these individuals would 
have called him at his parents residence. had no 
knowledge of anybody being involved in or discussing computer 
hacking. nas told of the legal ramifications of making a 
false statement, but again denied knowing LAMO and could not 
explain why he had been linked to LAMO. 


ictoria, Texas 


Date dictated 09/17/2003 bIE -3 
FBI(19-cv-1495)-410 bo -1 
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FEDERAL BUREAU OF INVESTIGATION 


Precedence: ROUTINE Date: 09/17/2003 


To: New York Attn: SA 
Squad DT-5 


From: Houston 
Victoria RA 
Contact: SA 


Approved By: 


Drafted By: g ! 
Case ID #: b3 -2 
Title: ADRIAN LAMO; ; OTE -3 


New York-Victim; 
Computer Intrusion 


Synopsis: Coverage of lead by Victoria RA, Houston division. 


b7E -3 
Enclosure(s): Enclosed for New York are the_original and one 
copy of FD-302's reflecting interviews of fo fan 
b6 -5 
b?IC =5 


Details: Cas interviewed and denied knowing 
Adrian Lamo. The details of these interviews are contained in 
the enclosed FD-302's. As no further investigation remains, 
Houston considers this lead covered. 


Document [Initia Date 
10K to Upload | 14 
Uploaded by | 

Serial # 


FBI(19-cv-1495)-414 


be -1 


To: New York From: Houston 
Re: 08/17/2003 DeicaZ, 


b7E -3 


LEAD (s): Ry 
Set Lead 1: (Info) 
NEW YORK 


AT NEW YORK, NEW YORK 


Read and Clear. 


+ 


FBI(19-cv-1495)-41 


D302 (Rev. 106.95) 
b6 -1 
b7c -1 


FEDERAL BUREAU OF INVESTIGATION 


Date of transcription 09/09/2003 


mn JPET 

Social Security Account Number 

home address, 
was interviewed on the morning of this date at his 

residence. After being advised of the official identity of the 

interviewing Special Agent (SA) and the nature of the interview, 
provide the following pertinent information: 


It is to be noted that 
DPOB: 
SSAN - was_presen xoughout this interview. 


Comments attributed toed be xeported 


separately.) 


bo -6 
b7C -6 


BACKGROUND: 


white male 


advised _he is employed 


telephone 


ADRIAN LAMO: 


2 or 3 years ago, his 
asked if ie 


[sdbeLieved LAMO 
Cd the interviewing SA 6 -5, —6 
displayed a photograph of_LAMO to] —_—_s| who advised tha he 


photgraph appeared to be[ 


Investigation on 09/09/2003 a@ Elizabethtown, PA 


y ; 3 i 
+ b3 -2 
—~b6 -1 
w SA srs FBICTSecv-1495)-414 


b7C -1 
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b3 -2 
bIE -3 
cuiminsrosne [| von 99/09/2003 ogg, 2 


described LAMO as bein uiet, an introvert and 
intelligent. recalled LAMO 
believed LAMO was from Northern California. He had a 
who named (Last Name Unknown) . 


recalled talking H (LNU) on the telephone. 


located_and_ then played to the investigating SA a piece 
of paper with[_——sdtelephone number as The, | 
handwritten note was identified to be in handwriting. b6 


b7C 
[LJ advised that LAMO was 


nd he knew very little about him. believed 
met _and communicated with LAMO via computer. He 
believed communicated with LAMO by using Instant 


Messenger. He did not recall long distance telephone calls being 
made between them. 
b6é -5 


Ld prc 


stated that 
Nevada on a couple_of occasions. He attended 
2 or 3 years ago. believed that LAMO may also be the type 
of person who would . 


MISCELLANEOUS : 
The interviewing SA read tol ___—Ja_series of names as 


provided by the New York Division Case Agent. advised that 
the only name he was familiar with on this list was 


-5, -6 
-5, -6 
, —6 
5, -6 


FBI(19-cv-1495)-419 


__} 


Pomel ae 
+4, GOT 15 2003 | 
; Ful — NEW YORK be -1 
b7C -1 


bo -1 
b7c -1 
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FEDERAL BUREAU OF INVESTIGATION 


Date of transcription _ 09/11/2003 
Date/Place of Birth (ppos): L__—id 


Social Security Account Number 


home telephone 
interviewed on the morning of this date at her residence. After 
being advised of the official identity of i viewing Special 
Agent (SA) and the nature of the ihtewiey eae the 
following pertinent information: 


was 


be -6 


to be noted that bIc -6 


aka, , Date of Birth: 
was pre durin ortion of this interview. nrormation 
attributed fob eS was made part of a separate report.) 


BACKGROUND: 


work telephone 


ADRIAN LAMO: 


When questioned regarding her knowledge of ADIAN LAMO, 
[stated that she did y xecall the name. by 
However, after listening to recollection, she ady'P© -5, -6 
she has some jimited recol 


———s 


advised i 


Investigation on a Elizabethto PA ic eee = 5 
wn, : d b3 -2 
File Date dictated og 09/2003 « ¥ b7E -3 
be -1 
w sat ses “FIA or 1095)4 7 70-1 
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bIE -3 


b6 -5, -6 
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ENY Amo, 0 


foe 
j 


- Rev, 01-31-2003) be -l 


b7c -1 


Precedence, ROUTINE Date: 09/30/2003 
‘ 


To: New York Attn: Se | 


From: Philadelphia - 
Harrisburg Resident Agenc be -1 
contacts SAL) 1 


Drafted By: ES) 
b3 -2 
Case ID # 
b7E -3 
Title: ADRIAN LAMO; 
NEW YORK TIMES-VICTIM; 
COMPUTER INTRUSION; 


Synopsis: Leads covered. 


b3 -2 


Administrative: Reference telephone_conversation between SA 
PH-HRA and SAL NYO, on 6-1 
09/09/2003. b7c -1 


Enclosure(s): Enclosed for the New York Division are the 
following: 


1) Original and one (1) copy of FD-302 Report of 
Interview of dated 09/09/2003 with 1A envelope 
containing original notes; es 
DG: S54, 796 


2) Original and one (1) copy of FD-302 Report of b7C -5, -6 
Interview of dated 09/09/2003 with 1A 
envelope containing original notes. 


Details: As requested in referenced communication, enclosed FD- 
302 reports reflect interviews conducted at the Harrisburg 


Resident Agency (HRA) at Elizabethtown, PA. As reported _in 
xeferenced telephone conversation, interview of De 


As discussed, were advised of 
the status of this matter and the e-mail address for the New York 


case agent. '. 


b3 -2 
BIE “3 


“ e@ @ 


To: New York From: Philadelphia 


It should be noted that investigation at HRA revealed 
an alias listed for in 
was identified as 


There does not _b6 -5, -6 
appear there is any misuse of identity on the part of Cs n7c -5, -6 


The interviewees reported that the captioned subiect?/E ~2 


They believed Lamo was 
elieve that befriended Lamo via a 


relationship over the Internet. They were not able to provide 
details regarding Dowie the captioned 


subject. 


No additional leads remain outstanding at the 
Harrisburg Resident Agency. 


FBI(19-cv-1495)-420 


To: New York From: Philadelphia 
nef] 03/30/2008 


LEAD(s): 
Set Lead 1: (Info) 
NEW YORK 


AT NEW YORK CITY, NEW YORK 


Read and clear. 


+ 


FBI(19-cv-1495)-421 


FD-302 (Rev. 10-6-95) 


FEDERAL BUREAU OF INVESTIGATION 
bé -l1, -6 
DAE rly tH6 
Date of transcription 10/01/2003 


or FO) 
Social Security Number 
Date of Birth Driver's license 
cellular telephone number | @-mail address 
s interviewed outside his residence by SA 
FBL._After being advised of the identity if 
the interviewing agent,L___] stated he_did not feel comfortable 
with law enforcement in his apartment..___] further stated he did 
not want to_inform the interviewing agent of his place of 
employment. did reveal that he worked in the technology field 
as was then advised the interview was 
& in regard to ADRIAN LAMO. 


On_ 09/30/2003 


stated he met LAMO 


stated he knew ADRIAN LAMO,. 


time he had heard from LAMO was 


had last seen LAMO during 
LAMO was living in the_Washington, DC area but did not know where. 
(CJfurther revealed 
LAMO was living in Washington, DC. 
One such place was the 

stated they had 

remember specifically what they talked about. 


further stated ayo[———"__]_ Pf 


he used live in an b7C -6 


did not 


apartment located on 
he did not remember the exact address nor the telephone number he 
had when he stated when LAMO 


but that he had 
stated he had 

specifically told LAMO 

[lees ea LAMO did not 

but that he had known LAMO was 


stated LAMO did 


AO fo eae 4 
DIE -3 
Investigation on__ 09/30/2003 ixvfax, Virginia b6 -1 
' b7c -1 
File Date dictated 10/01/2003 
by FBI(19-cv-1495}-422 
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Continuation of FD-302 of | 20n 09/30/2003 __, Page 2 


not have a job while[____ TT stated 
LAMO's parents supported him financially. : 


be -5, 
further stated he knew LAMO to b7c -5, -6 


stated he once 
he only knew Dy. Hepubation. 


that LAMO had called him and asked him 
was not involved in the conversation between 
could not recall where 
further stated sometime in 2001, he had 
stated 


bé -6 
b7C 
stated b3 -3 


further stated he had never 


he does not know why LAMO would hack major 
infrastructures/companies other than what he had read in the new 


or online. stated he did not associate himself with 


would not 
elaborate on the matter. further stated LAMO never provided 
him with a LexisNexus id to use. 


[7] stated he did not_know any or LAMO's other 
associates in that LAMO would 
tated he had asked LAMO 
stated that 


LAMO had 


Co Jstat used to use an e-mail address, . 7 
Adrian@adrian.org. further stated LAMO utilized the id bo -S, —6 
PROTAGONIST. BAC. -S5y. *=6 


When asked stated he knew to be an 
stated he knew the name 


further stated he knew the name 


by reputation onl 
who used to be a 


“This concluded the interview. 
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FEDERAL BUREAU OF INVESTIGATION 


Date of transcription 09/26/2003 


(Protect Identity), date of birth b6 -l, 6 


social security account number 


was interviewed along with 
(Protect i] date of birth 


6 
SH7D -1 
social security 
account number (Protect 
i i account number 
at the Northern_Virginia 

6 
6 


Identit: date of birt: 

es home address 
telephone number 

Resident Agenc NVRA) Of the FBI by Special acest sod 
land After being advised of the identities of 

the interviewing agents and the nature of the interview 


voluntarily provided the following information: 


graduated from bo -5, -6 

with a, degree in b7C -5, - 
While Ihe lived_in_a dorm the IxSy7p _1 
s he lived at 


He begins work at 
on 09/29/2003. His E-mail address while attending 


and is no_longer in service. His current 
Internet Service Provider (ISP) is in 
Co J and his current E-mail address is 


He married and_she shares the same 
ISP and has her own computer at their home. created 
a website for their wedding and he has never operated any other 
websites. He doesn't frequent any chatrooms on the Internet. 


described LAMO as 


that he was calling from a 
conversation LAMO also said that 


Investigation on 09/24/2003 at Falls Church, Virginia 
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[| 


ConinusionoftDsoze Tn 09/24/2003 Page De 


felt that this was made wp because LAMO used to b6 -6 
b7c -6 


[ ____s—Jreceived another telephone call from LAMO when he b7D -1 


"adrian@adrian.org| 
no contact with LAMO gi i heard from some of 
his friends that LAMO 
never saw or met with him. remembers someone telling him in 
college that LAMO was looking for a place to lay low but he didn't 
know why. : 


LAMO never mentioned any of his hacking activities to 
a ee his telephone in his E-mail._______]believes 6 -6 
that LAMO hacks to show he doesn't know of any significant) 7. wG 
come LAMO's life but does think the LAMO has an older sister. | 1 


nows nothing of LAMO's finances or if LAMO uses drugs. b7D 
However, he wouldn't be surprised if LAMO did use drugs. 


a is a good frieb6é -5, -6 
of nd he E-mails or Instant Messages with him b7C -5, -6 


approximately every other month. thinks that 
is attending school 
is a good friend of LAMO's as we 
Messaging ID is possibly 


pees 
De met{ at a Poy HOR 70 
never had any other contact with him BYE <5ip 26 


described LAMO as a very strange child and vey7p _1 
dvised that the 


and 
unusual. 
jand 

haven't received any telephone calls or heard from LAMO and LAMO 
has never stayed at their home. 


| 
FBI(19-cv-1495)-425 


The following investigation was conducted by Special 
Agent (say) FEDERAL BUREAU OF INVESTIGATION, Northern 


Virginia Resident Agency on 09/24/2003: 


sa(____]called the Federal Correctional Institution - 
Cumberland (FCIC), 14601 Burbridge Road South East, Cumberland, 
Maryland 21502, telephone number 301-784-1000, and spoke with 


LNU_in the records department. confirmed that 
aka Tnmate Register Number: 
is currently incarcerated at the facility. 
Dou = By 5. 
IC Ely 9235 F 9 


b3 -2 A 
ves Z OCT 6 6 2005 
b6é -1 fel ~ ny 
b7C -1 
pene 7oshaw FBI(19-cv-1495)-42 
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FEDERAL BUREAU OF INVESTIGATION 


Date of transcription 09/30 /2 003 


telephone mmbexL___—ids 


eing advised of the identity of 
the interviewing agent and the nature of the interview,[— 


provided the following information: 


date of birth 


and works for 
He is not and never has been a “hacker." He does 
not like the term hacker and rarely uses the word. He does have an 

ehavior and thus one would see_"hackers" 

He does that strictly to get 

He has three b6 -6 

computers that are networked in the house and he uses a wireless : 
router, His ISP is Cox Cable. He has no formal education in DIC -6 
computers and it is purely a hobby of his. He has a criminal 
justice degree. He did not want to reveal his email address but 
stated that he uses| He also uses his website for 
email and he can use any Ito get email. 


He knows Adrian Lamo although he does not consider him a 
friend. He knows very little about _Lamo's personal life and 
described Lano as weird. Lamol—— J 
several years ago. This all took place through Instant Messaging 
or email, ano get up an account on be 


when Lamo started getting into trouble. He does be -6 
not think that Lamo even used the account. bIC -6 


He has never met Lamo and does not know what his habits 
are or who his friends are. His only contact was through the 
Internet and his last contact was at least six months ago. His 
knowledge of Lamo is mainly derived from newspaper articles. He 
knows that Lamo seems to take_advantage of open proxy servers to do 
whatever it is Lamo does. stated that he has heard that most 
people do not think that LamO is as talented as the media portrays 
him. He assumes that Lamo uses Kinko's because of convenience and 
anonymity. He really has no first hand knowledge of Lamo's 
escapades or the reason he goes where he goes. He knew that Lamo 
had a Toshiba laptop at one point because Lamo told him that. 


Investigation NV 
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b7E -3 


Contimation of FD3020f _ [sd »0n 09/30/2003 _,Page _ —2— 


He knows little of Lamo's sex life although he has heard 
stories that range from Lamo being bisexual to Lamo traveling 
around the country to have sex with young boys. He does not know 
of any drug usage but heard he may have used ecstasy. 


[dvs not interested in becoming friends with Lamo so 
never had Conversations that were substantial. He did not want to 
know what Lamo was doing so he could not become an accomplice to 
anything. He never received information from Lamo nor provided 
any. Lamo 


BG =35,.2 55 
; , ; DE SOR By 
He is not sure if Lamo has enemies, but he feels cua 
do not like Lamo. He stated 
that Lamo land problems arose. He 
did not know what the problems were. 


He recognized the 
vie character name. 


personal level. 


He had nothing else to add except to reiterate that he is 
not a hacker and does not know any of these people mentioned 
personally. He has never given Lamo money and has never let him 
stay at his house. He does not approve of what Lamo does and since 

He would be b6 
willing to be recontacted if necessary. b7c 
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FEDERAL BUREAU OF INVESTIGATION 


Date of transcription 09/30/2003 


one nu 

cellular telephone number was interviewed. 

After being advised of the identity of the interviewing agent andpg _5 
the nature of the interview[__]provided the following pic —5 
information: 


She has never heard of Adrian Lamo and has no idea why 
her phone number would have been called by him. She rarely uses 
the computer and Lamo's name_does not even sound familiar. . She 
also talked to her husband, and asked him and he had no idea 
either. She does have 
and she asked if they knew him and they did not. She could provide 
nothing further, but is open to being recontacted if necessary. 


b3 -2 
b7E - 
File Date dictated be -1 
b7C -1 


Investigation on 09/30/2003 at Las Vegas, NV 


ty SA hj 
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CONTE HED 


: : : b6é -1 
bic -] 
. b3 -2 


The following investigation was conducted by Special 
Agent a 


On September 29, 2003, 
telephone 
number advised that she has lived in the apartment 
for approximately one and one half months. She does not know who 
is. 
On September 36, 2003 Pe icapins — -1, -3, -5 


advised that mb7C -1, -3, -5 
on December 5, 2002. She ee no forwarding information on her, 
but thought she still might Po 


On October 1, 2003 Power, L___| 
Co) advised that has no active power accour 
and left a forwarding address o 


On October 2, 2003, 7] Cox Cable, [ 
advised that they have no employee by the name o 


b3 -2 


D6 -1 — : 
pIc -1 a a 
| OCT ? 6 2nn3 i i 


54bU7.0 3 FBI(19-cv-1495)-434 


INVESTIGATION e, 


se see ROUTINE Date: 10/02/2003 
To: V New York Attn: 
Squad DT-5 
a b6 -1 
From: Las Vegas : b7c -1 
Squad 4 


Contact: saL 


Approved By: 


Drafted By: an 
: b3 
Case ID #: (Pending) bIE 
Title: ADRIAN LAMO; 
New York Times-Victim; 


Computer Intrusion 
oO :NY 


Synopsis: Leads covered. 


bIE -3 


Enclosure(s): Enclosed please find an original and one copy of 
an FD-302 of as well as original notes; and, an 
original and one copy of an FD-302 of oe] and original 
notes. Also enclosed is an insert reflecting investigation 
conducted. : 


Details: On September 30, 2003,[ lt interviewed and 
she had no idea why Adrian Lamo wou e Calling her telephone BE 23s -25 
number. She asked her husband and daughters and they did not pe ~ 
know Lamo either. See enclosed FD-302. bIC -3, -5 


On September 30, 2003, LJ was interviewed. He 
stated that he knew who Adrian Lamo was, but was not a personal 


friend and gained most of his knowledge of Lamo through newspaper 
articles. For the entire interview, see the enclosed FD-302. 


1, 2003, a check with 
ft a forwarding address of 
A lead for her to be interviewed is being 
left to the discretion of New York. 


On October 2, 2003, a check with Cox Cable, Lid 


revealed no employee by the name of 


FILED. 


A} oer 8 ~ 2003 


FBI(19-cv-1495)-439 


94 60$.03 


To: lew York From: Las Vegas : : 
Re: 10/02/2003 BBs 24 


Since all logical investigation has been conducted, Las 
Vegas considers these leads covered. 


To: : Las Vegas 
Re; 10/02/2003 b3 -2 
bIE -3 


LEAD (s): 


Set Lead 1: (Info) 
NEW YORK 
AT NEW YORK, NEW YORK 


nd clear. Set lead to Temple, Texas to interview 
if appropriate. b6 -3 


b7C -3 


aA 


FBI(19-cv-1495)-434 


(Rey, 01-31,2003). -# 
: BrC. =] 
FEDERAL BUREAU OF INVESTIGATION 
Precedence: ROUTINE Date: 10/01/2003 
To: “Newark : Attn: Computer Intrusion Squad 
New York Avene Sh (oo ee 
Squad DT-5 
From: Jacksonville . » be -1 


feaprapsie Rove bé -1 


ee pIC -1 
sg 5 
< 


asl 


Pensacola RA : b7C -1 


approved By: [[—_] 
Drafted By: [7] kid 

. bsH2 
Case ID af] (Pending bIE -3 


Title: ADRIAN LAMO; 
New York Times-Victim; 
Computer Intrusion; 
OO: NY 


Synopsis: To report results of investigation at Gulf Breeze, 
Florida, and to forward lead to Newark for coverage. 


DIE -3 


Enclosure(s): Enclosed for Newark Divisi i opy of the bs 
referenced EC dated_07/02/2003, and a database bo -3 
printout regarding b7C -3 


Details: For information of Newark Division, captioned subject 
is under investigation by the New York Division for the . 
commission of unauthorized computer intrusions into major 
corporations. Subject Lamo labels himself as a "white hat 
hacker." However, investigation has revealed that he is a "black 
hat hacker," which is someone who breaks into a computer system 
with the purpose of inflicting damage or stealing data. Each 
time he hacks a major corporation, he alerts friends in the, ¢ 
first and has them contact the victim for comment. 


= Pee s| 
DIG =Bipe 5! 
NYO has identified several groups of people that need 
to be interviewed regarding their knowledge of subject Lamo. 
Identified as residin territory was 
Contact at 
this address, revealed that no_ longer resides at the 


residence. a moved to 
| ee ee ate July or early August 2003. 


b3 -2 
DIELS 


FBI(19-cv-1495)-435 


To: @ acksonville : 
Re: 10/01/2003 base 
b7E 


The current resident, [1 _—S—S—C—] advised that 

was moving into a retirement inn/community in the Boies <5: 
area. fe he said to_be looking for a job im the °° ~%s 

area so that she can be close to =a BIC =2, =5 


b7E -2 


database se: 


were found residing in 
See enclosed EC dated 07/02/2003 for complete details 
regarding this matter. 


For information of New York Division, considering the 
above information, the Jacksonville Division, Pensacola RA will 
undertake no further investigative activities into this matter 
and thus, consider this investigation complete. 


Lead covered at Gulf Breeze, Florida. 


FBI(19-cv-1495)-436 


To: Newark ene @ 


LEAD (s):° 
Set Lead 1: (Action) 
NEWARK bon o3705 


AT TOMS RIVER, NEW JE 


to learn if she is the 
who use to reside at 


and conduct an interview 
as outlined in enclosed EC dated 07/02/2003. Report results to 
New York Field Office. : 


Set Lead 2: (Action) 
NEW YORK 


AT NEW YORK, NEW YORK 
Read and Clear. 


o 


FBI(19-cv-1495)-437 


DIG 3: b3 -2 


DTE: -3 


ee 1) ear 1 


WITHTEXT_U# 


WITHOUT TERT 
we Ge — 
DATE OCT 8 2003 


Ak 


eS ® FBI(19-cv-1495)-438 


ERATED. 


. _ be -1 
b7c -1 


ALL INFORMATICN 
SEREIN TS UNIL 


SIE O2-27 


be -1 
b7c -1 


FBI(19-cv-1495)-440 


FD-302 (Rey. 10-6-95) 


-1- 
FEDERAL BUREAU OF INVESTIGATION 


Date of transcription 10/08/2003 


On 10/7/03L_—idi Let the message on the voice 


mail of the writer. 


[Jstatea that his wife believes that it is_pointiess 
and refuses to be interviewed in regards to ADRIAN LAMO. a 
states he agrees. 6 -5 
stated the last time they saw LAMO was 1996, at b7c -5 
which time LAMO was 14. The only information the have regarding 

LAMO is that which they observed on the internet or through other 

media publications. Prior to 1996, they saw LAMO in either the late 
1980's or early is90's|—sfadvised they basically know nothing 

about LAMO. 


Lo Jaavisea if the New York office wants to subpoena 
them then fine. 


bo -1 
b7c -1 


FBI(19-cv-1495)-441 


£ 


10/7/03 


: . : 
Investigation on at Providence, 5 3-2 {télephonically), 
7 : Pa 7 Tre 
mee rr ee: TE [See disea 26/ - . 
bo -1 i 


bIC -1 


._It is the property of 


A/S 
@ @ fa 


---- Working Copy ---- Page 1 


Precedence: ROUTINE Date: 07/02/2003 bye 


To: Detroit Attn: Computer Intrusions Unit 
Sacramento 
Washington Pield 
Cincinnati 
Memphis 
New Haven 
San Francisco 
Los Angeles 
Baltimore 
Philadelphia 
Houston 
Cleveland 
Oklahoma City 
Newark 
Seattle 
San Diego 
Indianapolis 
Portland 
Omaha 
Milwaukee 
Little Rock 
Miami 
Jacksonville 
Chicago 
Springfield 
Minneapolis 
Honolulu : 
Boston 
Las Vegas 
Denver 
Dallas 
Atlanta 
Cyber 


bé -1 
b7c -1 


From: New York 
Squad DT-5 ay 


a Sl ——__—} 3° 
Approved By[_ 
AS 
Drafted ay: [____————idiS ou \ ao 
a ane: 


Title: ADRIAN LAMO; is ee oe yh i) 
WX 


New York Times-Victim; b7IE -3 \ 65 

Computer Intrusion; b6 -l1 AN cae 

00: NY b7c -1 “ \ 

: er OT Xe 
Synopsis: Conduct logical interviews O 


---- Working Copy ---- 
Enclosure(s): Packet containing fd} ACS checks, 
criminal history, DMV history and Internet checks 


on each interviewee bIE -2 


Copy of article from sfweekly.com of recent 
interview of the subject, ADRIAN LAMO 


List of suggested intexview questions for each 
interviewee (Suggested questions worksheet) 


Photograph of ADRIAN LAMO 


Details: ADRIAN LAMO is a twenty two (22) year old male who commits 
unauthorized computer intrusions into major corporations. LAMO is 
labeled in the media as the "homeless hacker". He considers himself a 
"white hat hacker", Investigation by the New York Office has revealed 
that LAMO is a "black hat hacker", an individual who breaks into a 
computer system with the purpose of inflicting damage or stealing 
data. Each time LAMO hacks a major corporation he alerts friends in 
the media first and has them contact the victim for comment. 


In September 2001, LAMO hacked YAHOO! and rewrote the text b6 -5 
of a YAHOO! News article. LAMO gained access through the portal’s c 
web-based production tools and modified a news story about DMITRY bic -5 
SKLYAROV, a Russian computer programmer facing federal criminal 
charges. LAMO used a free internet connection at KINKOS to commit the 
hack. YAHOO! was informed of the breach after being contacted by 
of securityfocus.com, who was contacted by LAMO. 

was convicted in 1990's by the FBI for committing unauthorized 

computer intrusions. 


In October 2001, LAMO contacted the reporter, be 
newsbytes.com to inform him that he had gained unauthorized access p7C -2, -5 
into a MICROSOFT customer service database. LAMO had gained access to 
MICROSOFT’s database is September 2001 but choose not to disclose his 
access until October 2001. LAMO utilized a vulnerability in 
MICROSOFT’s network that allowed an unpublished Internet Protocol (IP) 
address to be entered into a web browser. The IP address provided 
access to records of people who had bought products and services from 
MicrosorT.[_] contacted MICROSOFT to ask them for a comment for 
the story he was writing about the hack. This was the first instance, 
MICROSOFT learned of the intrusion. MICROSOFT confirmed the hack and 

described the incident as 
“an error that led to a breach of privacy, against our privacy 
policy". 


In December 2001, LAMO contacted the veporter |__| be -5 
| securityfocus.com, to inform him that he had gaine b7c -5 
unauthorized access into MCI WORLDCOM’s internal network. LAMO gained 
access to WORLDCOM’s internal network in October 2001 but choose not 
to disclose his access until December 2001. LAMO provided internal 
screen captures to WORLDCOM to prove he was the hacker. The screen 
captures from WORLDCOM’s internal network state, "Not to be reproduced 
in any manner or disclosed to unauthorized individuals". LAMO gained 
access to WORLDCOM’s internal network using a free internet connection 


FBI(i9-cv-1495)-443 


xINKOS. LAMO exploited a vulnerability in a WORLDCOM proxy server 
fo gain unauthorized access to their network. After committing the 
pack and reporting it toL______] LAMO commented "The downside is, I’m 
yunning out of major US Corporations". Also, one of LAMO’s prized 
possessions is a screen capture of WORLDCOM’Ss stock price falling 
after he announced he had hacked the company. 


-~--- Working Copy ---- Page 3 


Ge 


In February 2002, LAMO contacted the reporter, L____—d 
newsbytes.com to inform him that he had gained unauthorized access b6 
into SBC COMMUNICATIONS. LAMO gained access to SBC COMMUNICATIONS 
network in December 2001 but choose not to disclose his access until b7c -5 
February 2002. LAMO utilized an exploit to gain access to SBC’s 
internal network. LAMO used a free internet connection at KINKO’s to 
perform the hack. LAMO gained access to usernames, passwords, 
telephone numbers, addresses and other sensitive customer information, 


-5 


In February 2002, LAMO discovered several misconfigured 
proxy servers acting as doorways between the public Internet and the 
NEW YORK TIMES private intranet. LAMO contacted[ Jof 
securityfocus.com to inform him that he had gained unauthorized access 
into The NEW YORK TIMES intranet. LAMO utilized the proxy servers to 
gain access to the NEW YORK TIMES network. Once on the network, LAMO 
cracked a password for a userid with supervisor rights. Utilizing 
this userid he was able to broaden his access as well as perform 
certain functions within the network. LAMO created four (4) 
Lexis/Nexus accounts off of the NEW YORK TIMES intranet and utilized 
these accounts for himself and/or friends to run over 3,000 searches 
of individuals, address and/or court documents. 


LAMO has committed other computer intrusions into several 
other corporations such as AOL and EXCITE@HOME. Each time LAMO 
commits a computer intrusion on a high profile organization he reports 
the vunerability and intrusion to the media causing a distrust of the 
company’s clients. The above mentioned corporations have lost 
significant money and trust of their clients, 


In the enclosed San Francisco Weekly article, dated April 
16, 2003, LAMO states “he is preparing to announce, in a few days, 
weeks or months -- whenever he decides the time is right -- his 
biggest hack yet. On the record, he defines his target as a 
"oritical-infrastructure-related company"; off the record, he exhibits 
ample evidence of his repeated incursions into the corporations 
internal system." NYO believes that LAMO is a threat to the 
infrastructure of the United States. 


The NYO along with the Southern District of New York (SDNY) 
are currently completing a complaint charging LAMO with his 
unauthorized access into WORLDCOM, NEW YORK TIMES, LEXIS/NEXUS, SBC 
COMMUNICATIONS and MICROSOFT. The NYO and the SDNY will have the 
complaint completed the week of July 7, 2003. The NYO will charge his 
other hacks upon indictment. bé -3, -5 


bIC -3, -5 
LAMO is reports to be homeless and usually stays with ' ° 
friends or in hostels for lodging. LAMO makes money in the computer 


security field when ssary. His cell phone bill goes to his 
arents residence at 
IO keeps in contact with we mown hackers su 


_ FBI(19-cv-1495)-444 


---- Working Copy ---- 


Upon his arrest, the NYO has identified five (5) groups of 
individual who need to be interviewed regarding LAMO. In total 
approximately 225 individuals will be interviewed. The groups are as 
follows: 


1. Individuals he contacts via telephone 

2. Individuals he has close relationships with (Will 
be providing Grand Jury subpoenas) 

3. Individuals that were run in Lexis/Nexus 

4. Individuals whose 1P addresses were used to run 
unauthorized Lexis/Nexus searches (Will be 
providing Grand Jury subpoenas) 

5. Individuals he is friends with but are reporters. 

(We are currently obtaining Department of Justice 

approval to conduct these interviews) 


This communication is to address the individuals with whom 
LAMO and/or others performed unauthorized Lexis/Nexus checks obtaining 
personnel information over a year ago and/or individuals LAMO 
contacted telephonically. Please note, when interviewing these 
individuals investigation may reveal a friend, acquaintance, family 
member or themselves, not LAMO who performed the Lexis/Nexus checks. 
If this is determined, conduct logical interview about that particular 
individual. Also, interviewees may and/or may not be aware that their 
personnel information was obtained by unauthorized individuals through 
Lexis/Nexus, please handle discretely. Writer has enclosed a list of 
individuals who may have been provided with the Lexis/Nexus userids by 
LAMO (included in the list of "other names" in suggested questions 
worksheet) . 


The NYO has a | eriminal history 
checks, DMV checks, ACS checks and Internet checks on all the bIE -2 


individuals writer is requesting to be interviewed. Writer has put 
details pertaining to each interviewee in the leads section of this 
communication. Writer requests to be contacted by Agents who are 
assigned to conduct interviews either by telephone or email. The 
purpose of this request is to allow writer to contact the appropriate 
Agent to inform them of LAMO’s arrest, so that interviews can be 
conducted. 


Interviews pertaining to individuals he has close 
relationships with, individuals whose IP addresses were used to run 
unauthorized Lexis/Nexus searches and individuals he is friends with 
but are reporters will be sent under a separate lead. The NYO office 
is currently obtaining Federal Grand Jury subpoenas and Department of 
Justice approvals for these individuals. 


Set Lead 1: (Action) 
DETROIT 
b6 -5 
AT CLINTON TOWNSHIP, MICHIGAN b7C -5 


Conduct logical interview of 
after being informed 


FBI(19-cv-1495)-445 


a i ee 


is being interviewed in 
is being interviewed in Arlington, Texas. 


Before interview is conducted, contact writer with_name_of 
Agent who will be assigned to conduct logical interview of 


Set Lead 27: (Action) 
HONOLULU 
AT HONOLULU, HAWAII 
Conduct logical interview of 
telephone after being 
informed of LAMO’s arrest by writer. LAMO’s phone records show he 


5 6 
called above mentioned telephone number. — a 


Before interview is conducted, contact writer wit 
Agent who will be assigned to conduct logical interview of 
HONOLULU 


AT PAIA, HAWAII 


Conduct logical interview of 
telephone 
iter. 

LAMO. is being interviewed at 


where he attends school. The NYYO is enclosing Information obtaine’ 
on Pig to be b3 -1 


interviewed, if located at the above mentioned_address. The NYO is b6 -3 
obtaining a Federal Grand Jury subpoena for b7c -3, -5 
, 


Before interview is conducted, contact writer wit 
Agent who will be assigned to conduct logical interview of 


Set Lead 28: {Action) 


BOSTON 


AT SOMERVILLE, MassacuusTTs Set|ead to S 


business address: 

telephone [> C™C™~C Ab UG’ GANG, informed of AMO byb6 -1, -3 

writer. is a founding member ofL_ sd b7C -1, -3 
. ron 


Before interview is conducted, contact writer with_name of 
will be assigned to conduct logical interview of 


OSTON FBI(19-cv-1495)-446 


AT PROVIDENCE, RHODE ISLAND Set \ead to “Prev den 
RA PL _ 


---- Working Copy ---- Page 35 


after being Informed o S arres 


the NYO has revealed that[ jis a 


ora 7 
student at 


Before interview is conducted, contact writer with_name of 
Agent who will be assigned to conduct logical interview of 


BOSTON 


AT MONSON, wassacnueTTs Set |ead + SA 


Conduct logical in’ Lew of 
ee | eel eproe SEEGE D6 -1, -5 
eing anformed of LAMO’s arrest by writer. bic -1, 5 


a) 


Before interview is conducted, contact writer with name of 
Agent who will be assigned to conduct logical interview of 


BOSTON : 


AT SPRINGFIELD, MASSACHUETTS S<+ lead te S 


: Conduct logical int iew of 
Ce eer being informed of LAMO’s arrest 
y writer. 


“Before interview is conducted, contact writer with_name_of 
ho will be assigned to conduct logical interview of b6 -1, -5 


b7C -1, -5 


BOSTON 


AT MIDDLETOWN, RHODE ISLAND wet lead  Rrovidau 


i interview of G RA can 
after being informed oF LAMO’s arrest by 
Writer. 


Before interview is conducted, contact writer wit . « 
Agent who will be assigned to conduct logicah interview of be -l, -5 


BOSTON 


Conduct logical in jew of 
telephone 
Tnrormed 3. Ss arrest by writer. Also at a 


also to be interviewed. 


b7C -1, -5 
: Before interview is conducted, contact writer with name of 
Agent ill be assigned to conduct logical interview of 
OSTON FBI(19-cv-1495)-447 


AT NORTH KINGSTOWN, RHODE Istanp Se+ (ead +o 


_ “Providence RA PL 


e, ws ---- Working Copy ---- Page 36 
oF b6 -5 
Ua Conduct io: i jew of b7c -5 

telephone 
informed of LAMO’s arrest by writer. Also a 
j also to be interviewed. 

Before interview is conducted, contact writer with_name of 
Agent who will be assigned to conduct logical interview of 

BOSTON 

, sé 
AT LYNN, MASSACHUETTS Ser (end 4p 
i i i of 
telephone after 
ing informed of LAMO'’s arrest by writer. 

Before interview is conducted, contact writer with_nam £ 
Agent who will be assigned to conduct logical interview of 
Set Lead 29: (Action) 

b6é -1, -5 
LAS VEGAS b7Cc -1, -5 
AT RENO, NEVADA 
ical interview_of \ 
telephone informed 

Of LAMO’s arrest by writer. ACS is positive for 

Before interview is conducted, contact writer with_na 
Agent who will be assigned to conduct logical interview of b6 -5 

b7Cc -5 


LAS VEGAS 
AT HENDERSON, NEVADA 
Sonduct Lowical interview of [ee on 
EEE SES ESSE after pemng anromred OF TANS BE 6 
arrest by writer. b7C -6 


Before interview is conducted, contact writer wit of 
Agent who will be assigned to conduct logical interview of 


LAS VEGAS : 


AT INCLINE VILLAGE, NEVADA 


conduct logical interview of 
after being Informed of LAMO’s arrest : 
writer. helped in the capture and conviction of — : 


b6é -5 
: . . . . b7C -5 
Before interview is conducted, contact writer wit. 
Agent who will be assigned to conduct logical interview of 


LAS VEGAS 


FBI(19-cv-1495)-448 
| 


we 
Rev. 01-31-2003) E 92-27-2010 


8! MpOS ES 


‘) MFIN 19 UNCLASSIFIE ® 


New York A 
. Squad DT-5 


From: Boston 
P1/Providence_RA 


Contact: SA | . 
be -1 


Approved b7c -1 
Drafted By: jdp 

Case ID # @Pemdirg) 

Title: AD LAMO; 


New York Times - Victim; 
Computer Intrusion; 
OO: NY 


Synopsis: To provide results of lead to interview. Jand 


b3 -2 


Enclosure(s): Original and two copies of interview forL_ 


along with interview notes. 


Details: For the information of case agent, the writer had 
telephonically contacted 


he and his wife indicated to the writer that he would 


in regards to interviewing 


b6 


bTC 


b3 - 
b7E 


b6 
b7Cc 


contact him after talking to his wife. The writer did not receive 


any call back and subsequently left several messages for them to 


call, Eventually, the writer left a message asking for them to 


cail and if they choose not to discuss the_matter with the writer 


to at least call and state such. On 10/7, —S—s—C J deft a 


message on the writer's voice mail stating they do not wish to be 


interviewed. A summary of his message was documented in the form 


of the enclosed FD-302. 


Providence RA considers this lead covered. 


+ 


-1 


-1 


2 
-3 


FBI(19-cv-1495)-455 


UC BAW/DE/RYS b6é -1 


FD-302 (Rev. 10-6-95) is 


FEDERAL BUREAU OF INVESTIGATION 


eas 


Date of transcription 09/26/2003 


date of birth 
residing at was 
interviewed at the Northern Virginia Resident A: g 
Pike, Suite 200 S, Falls Church, Virginia 2) ecm 
Ler lta also present during the interview. After being 
advised of the purpose of the interview and the identity of the : 
interviewing Agents[_ _Jprovided the following information: be -2 
b7C -2 

She does not know_or associate with ADRIAN LAMO. She may 

have met him once, through 


approximately five or six years ago. She may have given LAMO and 
Ca Tout she does not remember the 


circumstances and does not specifically recall LAMO. 


Her last name was changed from in 
approximately 


She has never been a subscriber of Lexis/Nexus. She has 
never given anyone permission to open a Lexis/Nexus account in her 
name. She has never given permission to anyone to query her 
personal information through any Lexis/Nexus account. She has 
never queried her own personal information through Lexis/Nexus and 
does not know why someone would query her personal information 
through the service. 


Investigation on 09/25/2003 at Falls Church, Virginia 


File D3 -2 pate dicted Not Dictated 
SA b7E -3 
ty SA gtk be -1 
b7c -1 


This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your %O-cy- = 
it and its contents are not to be distributed outside your agency. PBICEO-cv-1495)-456 


03 GKICGF. 30 2 


- | 


refumn.wed. 


UPLOADED 
WHRHOUT IE. 
ay. QL 
BATE. OCT 8 MN . 


e@ @ FBI(19-cv-1495)-457 


Paes] b3 -2 


10/07/2003 DIE -3 
CAH:cah 
The attached letters rs a es \\: returned via 
Federal Express stating undeliverable. 
b6 -3 
b7c -3 


bo <1 
DiC a 


FBI(19-cv-1495)-45 


Wi eee B os fo 
wine E Z oS : 
DATE, +> b6 -1 ; : 
bIC -1 
ALL INFCRMATICN NED a - 
a“ Bae b6 -1 
<% as b7C -1 j 


wie 


e@ 7 Po @ FBI(19-cv-1495)-463 


FD-302 (Rev. 10-6-95) 


FEDERAL BUREAU OF INVESTIGATION 


Date of. transcription 10/08/2003 


i b3 -1 
telephone provided the be -3 


attached documents pursuant to a Federal Grand Jury subpoena issued p7c¢ -3 


out of the Southern District of New York —— any 


A copy of the documents will be maintained in the file. 


be -1 
b7c -1 
ie b3 -2 
Investigation on 10/07/2003 at New York, NY bIE -3- 
File Date dictated 10/07/2003 be -1 
biG 1 
ty SA FBI(19-cv-1495)-464 
‘This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agenoy; 
it and its contents are not to be distributed outside your agency. 


UPLOADED 
WITH/TEXT. 


WITH/OUT TEXT, 
BY. Qe _ . 
DATE, ° 


ALL INFORMATICN 
SEREIN TS UNIL 


SIE O2-27 


be -1 
b7c -1 


FBI(19-cv-1495)-498 


@ 


be -1 
DZG = 


(Rev. 01-31-2003) 


FEDERAL BUREAU OF INVESTIGATION 


Precedence: ROUTINE Date: 07/02/2003 
To: Newark Attn: Computer Intrusions Unit 
Cyber 


From: New York 
Squad DT-5 


Contact: sa [TT] 
Approved By: [UT] ie 


b7E -3 
prafted By: [1s 1f b6 =i 
case {__ (Renting sake 
Title: ADRIAN LAMO; 

New York Times-Victim; 
Computer Intrusion; 
Oo: NY : 


Synopsis: Conduct logical interviews 


Enclosure(s): Packet containing ACS checks, pD7E -?2 
criminal history, ernet checks 


on each interviewee 


Copy of article from sfweekly.com of recent 
interview of the subject, ADRIAN LAMO 


List of suggested interview questions for each 
interviewee (Suggested questions worksheet) 


Photograph of ADRIAN LAMO 


Details: ADRIAN LAMO is a twenty two (22) year old male who commits 
unauthorized computer intrusions into major corporations. LAMO is 
labeled in the media as the "homeless hacker". He considers himself a 
"white hat hacker". Investigation by the New York Office has revealed 
that LAMO is a "black hat hacker", an individual who breaks into a 
computer system with the purpose of inflicting damage or stealing 
Gata. Each time LAMO hacks a major corporation he alerts friends in 
the media first and has them contact the victim for comment. 


In, September 2001, LAMO hacked YAHOO! and rewrote the text 

F ‘of abfranodWNews article. LAMO gained access through the portal's 
web-based production tools and modified a news story about DMITRY 

MASKLYAROV, a Russian computer programmer facing federal criminal 


“AML! 


Rere 


FBI(19-cv-1495)-499 


TO: Newark From: New York 
Re: =a 07/02/2003 Deee 
bIE -3 


charges. LAMO used a free internet connection at KINKOS to commit the 
hack. YAHOO! was informed of the breach after being contacted by 
eae securityfocus.com, who was contacted by LAMO. 

was convicted in 1990's by the FBI for committing unauthorized 
computer intrusions. 


In October 2001, LAMO contacted the reporter, 
newsbytes.com to inform him that he had gained unauthorized access 
into a MICROSOFT customer service database. LAMO had gained access to 
MICROSOFT's database is September 2001 but choose not to disclose his 
access until October 2001. AMO utilized a vulnerability in 
MICROSOFT's network that allowed an unpublished Internet Protocol (IP) 
address to be entered into a web browser. The IP address provided 
access to records of people who had bought products and services from 
MICROSOFT. contacted MICROSOFT to ask them for a comment for 
the story he was writing about the hack. This was the first instance, 
MICROSOFT learned of the intrusion. MICROSOFT confirmed the hack and 

described the incident as 

"an error that led to a breach of privacy, against our privacy 
policy", bo. +2, 5 
DIC 25. 5 

In December 2001, LAMO contacted the reporter,L___| 

securityfocus.com, to inform him that he had gained 

unauthorized access into MCI WORLDCOM's internal network. LAMO gained 
access to WORLDCOM's internal network in October 2001 but choose not 
to disclose his access until December 2001. LAMO provided internal 
screen captures to WORLDCOM to prove he was the hacker. The screen 
captures from WORLDCOM's internal network state, "Not to be reproduced 
in any manner or disclosed to unauthorized individuals". LAMO gained 
access to WORLDCOM's internal network using a free internet connection 
at KINKOS. LAMO exploited a vulnerability in a WORLDCOM proxy server 
to gain unauthorized access to their network. After committing the 
hack and reporting it to[___ J LAMO commented "The downside is, I'm 


running out of major US Corporations". Also, one of LAMO's prized». aie 
possessions is a screen capture of WORLDCOM's stock price falling Pi 
after he announced he had hacked the company. 7-5 


In February 2002, LAMO contacted the reporter, 
newsbytes.com to inform him that he had gained unauthorized access 
into SBC COMMUNICATIONS. LAMO gained access to SBC COMMUNICATIONS 
network in December 2001 but choose not to disclose his access until 
February 2002. LAMO utilized an exploit to gain access to SBC's 
internal network. LAMO used a free internet connection at KINKO's to 
perform the hack. LAMO gained access to usernames, passwords, 
telephone numbers, addresses and other sensitive customer information. 


In February 2002, LAMO discovered several misconfigured 


proxy servers acting as doorways between the publi et and the 
NEW YORK TIMES private intranet. LAMO contacte £ 


FBI(19-cv-1495)-50 


To: Newark From: New York 


DIE -3 


securityfocus.com to inform him that he had gained unauthorized access 
into The NEW YORK TIMES intranet. LAMO utilized the proxy servers to 
gain access to the NEW YORK TIMES network. Once on the network, LAMO 
cracked a password for a userid with supervisor rights. Utilizing 
this userid he was able to broaden his access as well as perform 
certain functions within the network. LAMO created four (4) 
Lexis/Nexus accounts off of the NEW YORK TIMES intranet and utilized 
these accounts for himself and/or friends to run over 3,000 searches 
of individuals, address and/or court documents. 


LAMO has committed other computer intrusions into several 
other corporations such as AOL and EXCITE@HOME. Each time LAMO 
commits a computer intrusion on a high profile organization he reports 
the vunerability and intrusion to the media causing a distrust of the 
company's clients. The above mentioned corporations have lost 
significant money and trust of their clients. 


In the enclosed San Francisco Weekly article, dated April 
16, 2003, LAMO states "he is preparing to announce, in a few days, 
weeks or months -- whenever he decides the time is right -- his 
biggest hack yet. On the record, he defines his target as a 
"oritical-infrastructure-related company"; off the record, he exhibits 
ample evidence of his repeated incursions into the corporations 
internal system." NYO believes that LAMO is a threat to the 
infrastructure of the United States. 


LAMO was arrested on 9/9/2003 in Sacramento, California. 

The New York Office is continuing to conduct investigation into his 
illegal hacking activities by interviewing known associates. 
ae a known associate of LAMO.. 

LAMO and has remained _in contact with him. 
be interviewed in 
he is a 
telephonically contacted by Agents of the Boston Office who stated he 


would like to be interviewed in person and_would_ be cooperative in the 

investiaation. current wedges is [el 
telephone asked to be 

telephonically contacted to arrange a date and time for the interview. 


b6é -5 
bYC>-S 
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aw 


_ FOr > New York 
Re: 07/02/2003 b3 -2 


b7E -3 


Set Lead 1: (Action) 
NEWARK m= 

b6t.45 
AT NEW BRUNSWICK, NEW JERSEY bIC -5 


Conduct logical interview of ee 
— _] tleshone Contact by 
telephone to set up appointment to conduct interview with 


Set Lead 2: (Info) 


CYBER 
AT CYBER 


Read and clear. 


had 
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FEDERAL BUREAU OF INVESTIGATION 


Date of transcription og / 26 / 2003 


apartment 


and ephone number 


(formerly was also present at the 
interview. After being advised of the identity of the interviewing . 
agents, he provided the following information: b6 -2, -6 
b7C -2, -6 


contact with LAMO via email and telephone. 


summer of 1998, he attended a 
in the area, he spent time with LAMO, 


LAMO traveled to the Washington DC area and met with 


While in town, 


wireless connection to search the Internet for 


He stayed in 
iO travels by bus or train 


and assumed that he 


Investigation on 09/25/03 a Falis Church, Virginia b3 -2 
; ; bIE -3 
File # Date dictated yg 


by 
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LAMO traveled to 
LAMO at the 


Although, their relationship was no 


thought it would be nice to see an old 
riend. LAMO said he was 


Co) soHe stayed in 


During that Joe — —_ = use = — computer. 
could not reme 


er if he logged onto his service provider 
or if he provided LAMO with the 


assword. At the tim 
Anetica on bine (au) and 
‘(7 =The computer was con igured wit 


han icon on the desktop 
that would allow the user to double i 


did not know if LAMO accessed his 
However, LAMO spent most of his time on the 
During this trip LAMO was distant and quiet. LAMO had 
always been somewhat reclusive and distrustful but was more so this 
trip. He was generally not taking care of himself and his personal 


hygiene was very poor. Sometime between the last visit and this 
trip, LAMO began to 


stutter. LAMO felt that _he was an out cast. 
He never introduced 


LAMO always carried a satchel when he 


computer. 


iO attempted to 
teach 


did not 
and did not keep it. Other items possessed 
iO were an old gray laptop and a palm top computer. 


ry 


w 


The items 
were old, LAMO rarely had anything new. b6 -2, -6 
CD 6 
On_numerous occa HeP7C 2, 
would tell he should 


He would show 


im & he was 
aid _not know what 


@ was looking at and 
thought LAMO was lying. could not provide the name of any 
of the computer sites or companies into which LAMO had hacked. 
LAMO claimed that computer companies would hire him for computer 
security after he hacked their systems but never said which 
companies had employed him. He did say that he hacked AOL, and 
Worldcom. He also hacked the New York Times and exposed personal 
information about Times employees. Hacking was LAMO's hobby. He 
wanted to be a hero by exposing vulnerabilities. He would make 
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b7E -3 


Continuation of FD-302 of §__[7G 2, -6 ,On 09/25/03 >Page 3 
b7C -2, -6 


disparaging comments about large companies. He would send links 
and news articles to www.securityfocus.com. 


In 1997, LAMO was a moderator in the chat room 
“outproud" which became "planetout." He used the online monikers 
“pno_magus", "adrian", "sneakylittlefuck", and "magus2600." He had 
used the same mobile telephone number for years, 415-505-HACK. 


LAMO's parents are now livi 


@ other child 
He would be approximately 
n the mid-1990's the family lived in Arlington, 


attended middle school at the time. 


Irginia. 


b6 


did not ask LAMO to search his name in b7C 
LexisNexis. He has riot received any LexisNexis information or 
account_access from LAMO. 
His LexisNexis access through 
can be verified via 
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FEDERAL BUREAU OF INVESTIGATION 


Date of transcription 10/08/2003 


On October 6 social 


security number address 
telephons 
number was interviewed at bo 


regarding the captioned investigation. Also present at the bIC 
interview was social 
security number ate o ire After 
being advised of the identity of the interviewing agents and the 
purpose of the interview.C provided the following 
information: 


ADRIAN LAMO was_a 


ea = 
i when nbe -5, -6 
brought_LAMO to sometb7C -5, -6 


in the LAMO was withdrawn and 
unkempt in appearance. stated that the onl 
conversation was 


"small talk" and LAMO only spoke when spoken to. 


was unaware of LAMO's activities and that 
LAMO was "famous" and had been in the news for his hacking. 
was informed _of LAMO's notoriety and media coverage 
by looked on the Internet 
regarding LAMO after and did read articles 
about LAMO's hack of the New York Times. 


Investigation on 10/6/03 Arlington, Virginia 


File # b3 -2 3" dictated 10/8/2003 
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FEDERAL BUREAU OF INVESTIGATION 


Precedence: ROUTINE Date: 09/19/2003 
To: New York Attn: Squad DT-5 
SA 
be -1 
From: Omaha b7C -1 


Squad 5/Lincoln RA 
Contact: SA 


Approved By: —) 


Drafted By: | ee 2" 


b3 -2 


PATE 02-27-2010 


Title: ADRIAN LAMO; 
New York Times-Victim; 
Computer Intrusion; 


oO : NY 
Synopsis: To report the results of interview of | 
of 


Enclosure(s): One original and two copies of FD-302 of [ ———SC~sdYd; 
One 1A envelope containing notes of the interview. 


‘Details: date of 
birth social security account number was. 


interviewed regarding her knowledge and/or relationship with be 
subject Adrian Lamo. bIC 


(Cc Jhas never heard of Adrian Lamo. She knows nothing 
about computers or hacking. She does not own a_computer nor does 
she have x or the internet. a does 
not_know ated that she does have cousins in 
but she has never met them or 
to them to know where they are or what they do. 


CJ was surprised and shocked that her name would be 
linked to any wrongdoing[___]does_ not know how her name would 


have appeared in this investigation.[_  ]and_her husband live 
ona and seldom leave [[____]for any 
reason. onsiders this lead covered. 


b3 -2 
DIE -3 
be* 1 
b7C -1 
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To: New_York @ Omaha 
nes [OT] 09/29/2003 


LEAD (s): 
Set Lead 1: (Info) 
NEW YORK 
AT _ NEW YORK 


Read and clear. 


+ 
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Date of transcription 09/25/2003 


tte of birth social 
security account number residential address 


telephone number 
was interviewed 


cellular telephone_number 


present during the interview was his father, After 

being advised of the identity of the interviewing Agents and the 

purpose of the interview[—] provided the following b6 -5, -6 

information: - b7Cc -5, -6 
| The telephone number is an AT&T wireless 

number subscribed t He is the primary user of 


this cellular phone and uses it for both business and personal 
communications. He currently resides at the_aforementioned 


residential address but also Spends time at 
at 
J 


He has known ADRIAN LAMO as an associate for : 
approximately two or three years. He met LAMO ehrough[ 6s -5, -6 
| a mutual friend. and BE DIC 5, -6 
mown each other since He has had contact 


with LAMO, both in person and telephonically on approximately five 
or six occasions. 


The last time he spoke with LAMO was approximately six 
months ago when LAMO called him. On more than one occasion, he has 
met with LAMO at the LAMO 
was always accompanied by They would meet to 
socialize and dine. . They would 


He describes LAMO as being paranoid around new people, 


pactistical oc and eccentric. He has seen LAMO is possession of 


LAMO never provided him with computer hacking tips or 
hacking tools and never tried to solicit any type of computer 


Investigation on 09/25/2003 a Vienna, Virginia 
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a : 


hacking tips, tools, or information from him. LAMO did not like to 
talk about his computer skills. During the few times that LAMO b6 -5, 
talk about his computer skills, [DO Iyudgea that LAMO's skillsyjc _5 
appeared to be rudimentary or very basic. Through conversation, uc 
determined that LAMO most likely used Kinko's as his primary means 

for internet access. However, he has never accompanied LAMO to or 

from a Kinko's. 


When LAMO comes to the 
he would travel by public transportation, walk, or ride with 
He would spend the night at friends or associates 
houses to include LAMO would also travel to 
He believes that LAMO 
is homeless by choice, kind of a free spirit. 


He was not aware of any type of ethical code or standard 
that LAMO believed or followed. It was never discussed. He felt 
that LAMO's motivation for computer hacking was to get a 


He recalls that LAMO may have been_working with authors 
Do and/orp on a book Gaal. 


He did not know any of LAMO' i sociates other 
than erson named It appeab6 -5, -6 
that LAMO and may have been good acquaintances. ‘b7C -5, -6 


would often talk about| and he has read articles on 
securityfocus.com that has written about LAMO. He does not 
know os eeemamast securityfocus.com pays LAMO and does not know 
how LAMO financially supports himself, he assumes that his parents 
support him. 


LAMO has never stayed with him, used his telephone, or 
used his internet connection. He does not know anything about 
LAMO's family. 4 roximately b7C -6 
two and one half 


LAMO has used the America Online Instant Message (AIM) 
moniker "ADRIAN". Other than what he has read in news articles, he 
has no specific knowledge of LAMO's unauthorized intrusions into 
any corporation or infrastructure. He does not know of any future 
plans of unauthorized computer intrusions by LAMO. 
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b6é -6 
b7C -6 


He has seen LAMO in possession of a Fujitsu Lifestyle 
Notebook, gray in color, with a 12.1" monitor. The monitor is 
broken at the hinges. 


He recognized the name Mark Abene as being the character 


"fiber optic" in Jon Quinten's book "Masters of Deception". The 
book is about a gang that ruled cyberspace. 
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Precedence: ROUTINE Date: 10/09/2003 


To: New York atten: sa] 


From: Memphis 
Squad 8 


contacts sx[ ote 3 
b7C -1 
Approved By: [VU] 


Title: ADRIAN LAMO; 
New York Times - Victim; 
Computer Intrusion; 
oo: NY 


Synopsis: ee and interviewed at pyc = 
Memphis, Tennessee. telephonically contacted at 2 


Philadelphia, Pennsylvania. 


Reference: b3 -2 
b7E -3 
Enclosure(s): Enclosed for New York_are two copies of FD-302 
reflecting telephonic interview of See 
Details: was telephonically contacted at 
his home in His mother, of 
provided his home telephone number of 
stated he had already been interviewed about ADRIAN T.aMn 5 
by FBT agents in[O contact SA po -1, -5 
b7c -1l , -5 
a telephonically contacted on 
his personal ce phone an oes not have a hard-line telephone 
at his home. He could provide very little information about 
LAMO, He did state that his mother[__——S—s——_.___] Knows 
nothing about LAMO and also his grandfather is deceased therefore 
Memphis will not interview them as listed in referenced lead(s). 


These leads are considered covered in the Memphis 


Division. 


b3 -2 
bIE -3 
b6é -1 
b7C -1 


SeAliZE FRED, 


FBI(19-cv-1495)-512 


To: New ¥ : Memphis 
Re: 10/09/2003 


LEAD (s) : 
Set Lead 1: (Info) 
NEW _YORK 


AT NEW YORK CITY, NEW YORK 


Read and clear. 
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was contacted and interviewed 


telephonically at his home, 
fo aeye his personal cell phone number as 
stating he does not have a hard line telephone _in his home. He 


called the interviewing agent after his mother 

called him to inform him the FBI was looking for him. He was 6-5 

interviewed concerning ADRIAN LAMO. ee ae 
C5 


does not know LAMO personally and has only 
heard of him from news articles on the internet, specifically from 
articles on WWW.SLASH.COM and WWW.CNN.COM. He has never talked to 
LAMO either in person or on the internet or in chat rooms. He was 
familiar with LAMO and the New York Times computer intrusion from 
news articles. He has heard that LAMO roams the country using his 


laptop to access the internet. He believes LAMO is friends with 
ee knew of no other 


friends of LAMO. bo -5 
jd = 
stated he has no formal training on computers 
and software and has learned what he knows from experience. He is 


a and works from_his home. He 
maintains al a 
his mother knows nothing of ADRIAN LAMO. He state Is 


grandparents are deceased. [[—S—C*dJ could provide no additional 


information. 
Investigation on 10/09/2003 a Memphis, Tennessee (telephonically) 
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Precedence: ROUTINE Date: 07/02/2003 
To: Houston Attn: SA Pitas Re eel 
San Antonio Attn: Computer Intrusions Unit 
Cyber 
From: New York b6 -1 
Squad DT-5 


bic -1 


Drafted By: (sie 


b7E -3 


Title: ADRIAN LAMO; 
New York Times-Victim; 
Computer Intrusion; 
OO: NY 


N Synopsis: Conduct logical interviews 


Enclosure(s): Packet containing| dl ACS checks, DIE -2 
criminal history, DMV history and Internet checks 


on each interviewee 


Copy of article from sfweekly.com of recent 
interview of the subject, ADRIAN LAMO 


List of suggested interview questions for each 
interviewee (Suggested questions worksheet) 


Photograph of ADRIAN LAMO 


Details: ADRIAN LAMO is a twenty two (22) year old male who commits 
unauthorized computer intrusions into major corporations. LAMO is 
labeled in the media as the "homeless hacker". He considers himself a 
"white hat hacker". Investigation by the New York Office has revealed 
that LAMO is a "black hat hacker", an individual who breaks into a 
computer system with the purpose of inflicting damage or stealing 
data. Each time LAMO hacks a major corporation he alerts friends in 
the media first and has them contact the victim for comment. 


In September..2001, LAMO hacked YAHOO! and rewrote the text 
of aLVAHOOL eNews: article. LAMO gained access through the portal's 
web-based Broducl ion tools and modified a news story about DMITRY 


fig 
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H| 
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To: -__New York 7 
b7E -3 


SKLYAROV, a Russian computer programmer facing federal criminal 
charges. LAMO used a free internet connection at KINKOS to commit the 
hack. YAHOO! was informed of the breach after being contacted by 
as ( securityfocus.com, who was contacted by LAMO. 

was convicted in 1990's by the FBI for committing unauthorized 


computer intrusions. 


be -5 
b7c -5 


In October 2001, LAMO contacted the reporter, 

newsbytes.com to inform him that he had gained unauthorized access 

into a MICROSOFT customer service database. LAMO had gained access to 

MICROSOFT's database is September 2001 but choose not to disclose his 

access until October 2001. LAMO utilized a vulnerability in 

MICROSOFT's network that allowed an unpublished Internet Protocol (IP) 

address to be entered into a web browser. The IP address provided 

access to records of people who had bought products and services from 

MICROSOFT. [J contacted MICROSOFT to ask them for a comment for 

the story he was writing about the hack. This was the first instance, 

MICROSOFT learned of the intrusion. MICROSOFT confirmed the hack and 
described the incide>t =< 

Tan error that led to a breach of privacy, against our privacy?® 72, 7-5 

policy". b7C -2, -5 


In December 2001, LAMO contacted the veporter,_—di 
(CJsecurityfocus.com, to inform him that he had gained 
unauthorized access into MCI WORLDCOM's internal network. LAMO gained 
access to WORLDCOM's internal network in October 2001 but choose not 
to disclose his access until December 2001. LAMO provided internal 
screen captures to WORLDCOM to prove he was the hacker. The screen 
captures from WORLDCOM's internal network state, "Not to be reproduced 
in any manner or disclosed to unauthorized individuals". LAMO gained 
access to WORLDCOM's internal network using a free internet connection 
at KINKOS. LAMO exploited a vulnerability in a WORLDCOM proxy server 
to gain unauthorized access to their network. After committing the 
hack and reporting it to L_ =~ *)] namo commented "The downside is, I'm 
running out of major US Corporations". Also, one of LAMO's prized b6 -5 
possessions is a screen capture of WORLDCOM's stock price falling b7c -5 
after he announced he had hacked the company. 


In February 2002, LAMO contacted the reporter, [___] 
newsbytes.com to inform him that he had gained unauthorized access 
into SBC COMMUNICATIONS. LAMO gained access to SBC COMMUNICATIONS 
network in December 2001 but choose not to disclose his access until 
February 2002. LAMO utilized an exploit to gain access to SBC's 
internal network. LAMO used a free internet connection at KINKO's to 
perform the hack. LAMO gained access to usernames, passwords, 
telephone numbers, addresses and other sensitive customer information. 


In February 2002, LAMO discovered several misconfigured 
proxy servers acting as doorways between the public Internet and the 
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To: Houston From: New York 
bIE -3 


NEW YORK TIMES private intranet. LAMO contacted [__]et 
securityfocus.com to inform him that he had gained unauthorized access 
into The NEW YORK TIMES intranet. LAMO utilized the proxy servers to 
gain access to the NEW YORK TIMES network. Once on the network, LAMO 
cracked a password for a userid with supervisor rights. Utilizing 16 -5 
this userid he was able to broaden his access as well as perform p7c —5 
certain functions within the network. LAMO created four (4) 
Lexis/Nexus accounts off of the NEW YORK TIMES intranet and utilized 
these accounts for himself and/or friends to run over 3,000 searches 
of individuals, address and/or court documents. 


LAMO has committed other computer intrusions into several 
other corporations such as AOL and EXCITE@HOME. Each time LAMO 
commits a computer intrusion on a high profile organization he reports 
the vunerability and intrusion to the media causing a distrust of the 
company's clients. The above mentioned corporations have lost 
significant money and trust of their clients. 


In the enclosed San Francisco Weekly article, dated April 
16, 2003, LAMO states "he is preparing to announce, in a few days, 
weeks or months -- whenever he decides the time is right -- his 
biggest hack yet. On the record, he defines his target as a 
"critical-infrastructure-related company"; off the record, he exhibits 
ample evidence of his repeated incursions into the corporations 
internal system." NYO believes that LAMO is a threat to the 
infrastructure of the United States. 


LAMO was arrested on 9/9/2003 in Sacramento, California. 
The New York Office is continuing to conduct investigation into his 
illegal hacking activities by interviewing_known associates. sd: 
ess a known associate of LAMO. eas interviewed in 
the past and provided information pertaining to LAMO and other know7 


hackers, is the nd ig a b6 -3 
whom she now dislikes. Many b7c -3 


interviews already conducted in the above mentioned investigation 
reveal eS 
about LAMO. The Las Vegas Division attempted to interview| 
at her last known address but results were negative. The Las Vegas 
Division Provided the NYO with a new address foro 

The Victoria, TX RA interviewed 


with negative res 
the New York Office has revealed that 


Further investigation _b 


telephone number 
Investigation has revealed tha de telephone calls to that 
residence during the time the resided there. be -5 
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Set Lead 1: (Action) 
SAN ANTONIO 


AT TEMPLE, TEXAS 
ical interview of bo -3 
—— oe ACS is positive for She was 7G: 23 
interviewed in the past vided information pertaining to LAMO 
Cand is a whom 


she now dislikes. 


Set Lead 2: (Action) 


HOUSTON HE OS 
AT VICTORIA, TEXAS bic -5 
Conduct logical interview 

to determine the identity an 


location of 
familiar with LAM 


telephone number} 
| 


Set Lead 3: (Info} 


her[_ is 
lived with 


If located, conduct logical interview 


AT CYBER 


Read and clear. 


had 
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55666 .03 


TOG 


The following investigation was conducted by saT Cd 


at on October 2, 2003: 


contacted writer telephonically and 6 
advised that he was flying out of town today and would not be b7C 


availabl, interviewed until his return in about a week and 
a half. requested he either one of his 
cell telephones, lox He also indicated 


that he would be either_at his residence at 
or in 


bé -1 
b7c -1 


b3 -2 
bIE -3 
be -1 
b7C -1 
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To: New York xa: Squad DT-5 


b6 
DIC 


sal] 


Seattle Attn: Computer Intrusion Unit 


From: Portland 
Sq 4 


approved sy: [fl 


Drafted By: [_—sdd ney b3 -2 


[se a 
Case ID #: (erdsng) 


Title: ADRIAN LAMO; 
New York Times - Victim; 
Computer Intrusion; 
OO: NY 


Synopsis: To cover and set lead. 
Enclosures (s): Enclosed for Seattle is one copy of referenced 
EC with accompanying documents pertaining tol b6 


b7C 
Ref : 
onerenee [ti“(t;isé‘CSCsé‘sidz b3 


Details: Referenced communication set forth a lead 18) for D7E 
Portland to conduct logical interview of 


after being advised of 
the arrest of Adrian Lamo. 


Referenced E-mail from sf 9/5/03, 
advised of Lamo's wanted status and go ahead €o conduct 


interviews. an_attempt was made to contact and 
interview 


Contact with the apartment 
Manager determined that[ ss Thad moved. Further contact_with 
telephone number 

a_forwarding address of 


2003. 


b3 -2 
b7E -3 
be -1 


b7c -1 
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-l, -5 
-1l, -5 
-2 
-3 


. 


To: i ¥. : Portiand 
Re: 09/19/2003 


LEAD (s) 
SEATTLE 


AT MOUNTLAKE TERRACE: 


Locate and interview 
using suggested interview 
questions included in referenced, attached NY EC. 


FBI(19-cv-1495)-52 


The following investigation was conducted by Special 
agent[ son September 8, 2003: bé <1, <5 
' 


AT SILVERDALE, WASHINGTON b7ICc -1l, -5 


Date of Birth 
was contacted at 


Social Security Number 


telephone number regarding 
Adrian Lamo and a telephone cail that Lamo_apparently made to 
telephone number last year. poe Twas informed 
that Lamo was wanted by the FBI on charges of computer intrusion. 
stated that she does not know anyone named Adrian Lamo 
and, moreover, she does not even own a computer. 
advised that she has resided at her current address with the same 
telephone number since February 2002.[7__— added that she 
does not have a roommate and has had no longer term visitors. 


(C____] was asked about her daughters and if either 

might know Lamo or might have received a telephone call last year |. . 
from Lamo. identified her daughters as bo -5 
issn tame LT seentitie ee dauabiere g¢ wear ala) PF, 
expressed that neither daughter is married and_she does not 

recognize the name Lamo with_respect to them. Cee rtd 

that both daughters ibe al and the only time 

they have been to her residence was when they both 

visited at the end of July last year for a couple days. 


provided the following information to further 
contact her daughters: bé -1, -5 


b7C -1 , -5 
b3 -2 
DIE -3 


Home telephone number: 
Cellular telephone number: 


{arn 25200 


te 


Cellular telephone number: 


Co Tadvised that she has received numerous 
telephone calls from individuals looking for a(t ——d 
[explained that she once received a telephone call from 


FBI(19-cv-1495)-523 


the olice Department who was looking 
for and a called about three days and left a 
call back number of 


was further identified through the[__] 
[____]Police Department as follows: 


Lo] 


white 


bo -3, -5 
b7C -3., -5 
Str 
170 lbs. 
Brown 
Hazel 


Name : 

Race: 

Sex: 

Date of Birth: 
Height: 

Weight: 

Hair: 

Eyes: 
Scars/Marks/Tattoos: 


FBI Number: 


Social Security Number: 


Last Known telephone 
Number: 
Criminal History: 


Wants/Warrants: 


FBI(19-cv-1495)-524 


(Rev, 01-31-2003) 


Precedence: ROUTINE Date: 10/03/2003 


To: New York Attn: fSonad DT-5 
SSA 


From: Seattle 
Silverdale b6 -1 
contacts safe 
pratted By: [fe 


Title: ADRIAN LAMO; bIE -3 
NEW YORK TIMBS-VICTIM; 
COMPUTER INTRUSION 


Synopsis: Lead to contact [bs -5 
a regarding telephone call allegedly received from b7c -5 
rain Lamo covered with no positive provided. 


Reference: b3 -2 
b7E -3 


Enclosure(s): Enclosed for the receiving office is the original 


and one copy of an investigative insert setting forth the results 


Details: The above referenced communications requested Seattle 
to contact individuals in Seattle, Silverdale and Veradale, 
Washington in order to determine why Adrian Lamo contacted the 
individuals as reflected on Lamo's telephone records. Only one 
lead was set to Seattle even though the leads involved territory” 
covered by two separate Resident Agencies and Headquarter City. 
As a result the leads were actually being covered by three 
separate agents: Leads at Silverdale, Washington were covered by 

i Seattle, Washington were covered by SA 

a lead at Veradale, Washington were b6 -1, -5 

covered by b7c -1 ,-5 


The results of the leads at Silverdale are set forth in 
the enclosed investigative insert. 


was contacted at her residence. Istated that 
she does not know anyone named Adrian Lamo and, moreover, she 
does not even own a computer. advised that she has 


resided at her current address with the same telephone number 


FBI(19-cv-1495)-525 


To: \ oe e 
Re: 10/03/2003 bie a2 


bTE -3 


since February 2002. advised that both her daughters 

live in and the only time they have been to her 
residence was when they_both visited at the end of 

duly last year for a couple days. advised, however, 

that she has received numerous telephone calls from individuals 

looking for a(—“—*‘C—CSCSCSCSCSCSCCCCCC. is further described in the _ 

insert. bo -3, -5 

b7c -3, -5 

In light of the above information, Seattle considers 

the leads at Silverdale, Washington covered. 


2 FBI(19-cv-1495)-526 


© ® 
TO: Seattle 


, 


LEAD (s) : 
Set Lead 1: (Info) 
NEW YORK 


AT NEW YORK, NEW YORK 


Read and Clear. 


277PG01.EC 
had 


FBI(19-cv-1495)-527 


10/92/2003 15:32 FAX e@ STEINHART & FALCONER Lue ~+ 696/007 
. —, . ah ss 


U.S. Department of Justice 


Federal Bureau of Investigation 


ev 


In Reply, Pleate Refer to 26 Federal Plaza 
File No, New York, New York 10278 
September 19, 2003 


To whom it may concern: 


Pursuant to Title 18, United States Cade, Section 
2703(f) you are hereby directed to take all steps necessary to 
idence in the possession of 
Such records and evidence 
ry are nO Mite O Racker documentary film, notes; 
photographs, files, communications, E~mail messages, programs, 
client account records and files, and any other documents: worked 
on,: veviewed by, drafted by, aditad by, examined by, ceceived by, 
sent to or pertaining te Adrian Lamo. . . ? 


This request is made in anticipation of an appropriate 
Order requiring the production of all information {including 
content) pursuant to the Electronic Communication Transactional 
Records Act, 18 U.S.C. § 2701, et seq. Under Section 2703(f), 
you are required to preserve these items for a period of 90 days. 
This period is subject te renewal. 


- Please be advised that your failure to comply with this 
request may subject you to criminal penalties, including, but not 
limited to, obstruction of justice under 18 U.S.C. § 1503, et 
seq. 


. Because this request in being made pursuant to an 
official criminal investigation, you are requested nor te 
disclosa this request, er fts contents to anyone. 


FBI(19-cv-1495)-53 


| 


10/02/2603 15:31 Pax 


STEINHART & FALCONER LP _ 16077007 
> 


We 


| 


. If you have any questions or ne iri b6 -1 
information, pleas ct Spacial Agent at 
fax (212) 384-4660- b7c -] 


Sincerely, 


Pasquale J. Damure 
Assistant Directer in Charge 
New York office 


upervisory Special Agent 


FBI(19-cv-1495)-534 


b7c -5 


b3 -2 
bIE -3 
UBLOADED 
wirurexr__ 
WITH/QUT TEXT. 
BY. OL ; . 
DATE 
ALL IW: 
REREIN I5 
ERTE t2-2 b6 -1 
b7c -1 


LL a e @ FBI(19-cv-1495}-535 


FD-302 (Rev. 10-6-95) 


FEDERAL BUREAU OF INVESTIGATION 


Date of transcription ) /12 {2003 


telephone telephonically 

contacted the interviewing agent. After being advised as to the 
identity of the interviewing agent and the purpose of the be S45 
interview. ] provided the following information: b7C -4, -5 


ot the[___ | 
stated he was calling on behalf of 


who the interviewing agent had just spoken to.[—[___]was informed 
thatL_____]had evidence pertaining to the investigation into ADRIAN 
LAMO and requested the evidence be preserved until Department of 
Justice approval could be obtained to subpoena the evidence and 
possibly to testify.[7 _Istated that there may be First 
Amendment issues_if we were asking for anything outside the scope 
of the article. was told that questions would only pertain 
to what was written in the articles byl __Jand that the evidence 
in question was spoken about directly in the articles. The 
interviewing agent stated that it may be_better for and 
Assistant United States Attorney (AUSA) speak about 


these matters.[ _Jagreed. ‘The interviewing agent provided 
[with the contact information of ausal | 


Investigation on 09/11/2003 New York, NY (telephonically) 


meeL TS =2 pa scat 99/22/2003 
bIE -3 
by SA bo -1 


b7c -1 
This document contains neither recommendations nor conclusions of the FBI. it 1s te property of the PBI and is loaned to your agepsyr 4 g_-y- ; 
it and its contents are not to be distributed outside your agency. PBI19-cv-1495)-53 


[fort ees, 


UPLOADED 
WITHTEXT. 


WITHOUT EXT. 
py_G Wg 
DATE cr 4 18, 


FBI(19-cv-1495)-537 


7 | 
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TIAINED 


" 
al Ul 2AN/o! 


oye 


bo 
b7C 


FEDERAL BUREAU OF INVESTIGATION 


Date of transcription 9/12/2003 


telephone 
Date of Birth (DOB) 
was telephonically contacted by the interviewing agents. After 
being advised as to the i ity of the interviewing agent and the 
purpose of the eee be advised that due to his status 

as a reporter he did not have to answer any questions if he did not 
wish to do sol _]then provided the following information: b6 —-5 


confirmed that he was the individual who had BIC -5 
and_ informed them that 


ADRIAN LAMO had provided 
when he had hacked their network. stated that the 
were approximately 15 months old. [_____]further 
Stated that he had previously reported_on this hack of ADRIAN LAMO. 
as he stated to 
went on to further state that he was not sure where some of the 


were and could not provide a concrete answer of 
what happened to them. 


ADMINISTRATIVE b6 -5 
qi 2 i : ri F eee LE = 5 
is point in the interview, the interviewing agent 
informed that she appreciated his cooperation in this matter. 
The_intervirewing agent further asked for the contact information 
for attorney to contact in the future regarding preserving 


the evidence in the investigation that[___ ]had in his possession. 
stated that he did not have the name and number on hand but 
would forward it to the interviewing agent_when he received it. 
The interviewing agent further advisedL — |ehat he may be a 
potential witness in the investigation and if he had any questions 
or desired to write a story on the investigation he would have to 
contact the New York Office Press Office. The interviewing agent 
provided[ with the contact information for the NYO Press 
Office. 


Investigation on 09/11/2003 at New York, NY (celephonically) 


{ ae Date dictated 09/12/2033 
DIE -3 
SA sd 


biG Lr 


This document contains neither recommendations nor conclusions It is the property of the FBI and is loaned to your agenpy: 
it and its contents are not to be distributed outside your agency. FBI(19-cv- 1495) 


Ak: 
-1 


“53 


Fnqgec wed 


UPLOADED 
wrrHrext__af 
witwouy TEXT______— 


| a 


CATE 02-27-2010 BY [r= BAW OK /RYS 


b6 -1 
b7C -1 


e @ FBI(19-cv-1495)-534 


ALL INFORMATION 
SERE TLA 


be -1 
b7c -1 
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FEDERAL BUREAU OF INVESTIGATION 


Date of transcription 10 {i 0/2003 


telephone 


y the interviewing agent./ 
being advised as to the identi f£ the interviewing and the 
purpose of the interview, iprovided the following b6 -5 


information: bIC -5 


es a TRIGGER STREET PRODUCTIONS 
(TRIGGER) | is a film production corpany_for free lance 


producers. The interviewing agent explained to[ __—sidi that: an 
on-line article quoted a member of thd____—sdfrom TRIGGER 
that was documenting“ADRIAN LAMO>while he was a fugitive stated 
that provided LAMO wrthrfeSafe place to hid from authorities ,when 
they knew he was wanted by the FBI. The article also stated’ that 
they filmed the five (5) days that LAMO was a fugitive. 

a cell phone number was the individua rom 
TRIGGER tha 


The interviewing agent asked | to voluntarily 
preserve the video that _]had recorded during LAMO's five (5) 
days as a fugitive. Istated that she would cooperate with 
authorities in this matter. e interviewing agent provid 
ith the Assistant United States Attorney (AUSA} 
contact information. 
be -4, -5 


b7C -4, -5 


SS 


Investigation on 09/11/2003 -@t New York, NY (telephonically) 


2 a nce ee 
File # DIE -3 ate dictated 09/11/2003 
b7C -1 


of the FBI It is the property of the FBI and is foaned to your agency; 


contains neither recommendations nor conclus 
iis contents are not to be distributed outside Your agency. 


b3 -2 


b7E -3 
bo -1 
b7c -1 
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FEDERAL BUREAU OF INVESTIGATION 


Date of transcription 10/07/2003 
On October 7, 2003, Gate of birth 


iding at 
telephone was interviewed at 
its place of business 


which is located at the same address above. 
As Special Agent approached, produced a video 
camera and videotaped the interview. After being advised of the 
identity of the interviewing Agent and the nature of the interview, 
mene denied having any knowledge of Adrian Lamo and refused 
to be interviewed. 


b6é -1, -5 
bee, 215-055 
Investigation on 10/07/2003 a Columbus, Indiana 
File # ogee Date dictated 10/07/2003 
wy SA b6 —1 (1:\SQ4\280RKD02.302) FBULS Cv Ah05).282 
b7¢e -1 


This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; 
it and its contents are not to be distributed outside your agency, 


(Rev. 01-31-2003) 


ale 


1 


e@ : bé -1 


b7c -1 
FEDERAL BUREAU OF INVESTIGATION 
Precedence: ROUTINE Date: 10/07/2003 
To: New York acen: saL 


Squad DT-5 


From: Indianapolis 
Squad 4 pé -1 


Drafted By: rkd (I:\SQ4\280RKD03 . BC) 


Title: ADRIAN LAMO; DTE 3 
New York Times - Victim; 
Computer Intrusion; 
OO :NY 


Synopsis: Lead covered Columbus, Indiana b3 -2 


Enclosure(s): Enclosed for the New York Office is an ouicingl 


and ons sony of a FD-302 reflecting the interview of 


Details: On 10/07/2003, was located at his place 
of residence, 
Lo re used to be interviewed. 


b6 -5 
b7IC -5 


This lead is considered covered by the Indianapolis 
Division. 


b3 -2 
bITE -3 
bo -1 
b7C -1 


eonpna 


dail 2 0 ebus 


FBi— NEW YORK : 


FBI(19-cv-1495)-543 | 


To: New York From: Indianapolis 


DS. =2: 
BYE. +3 
LEAD (s) : 
Set Lead 1: (Info) 
NEW YORK 
AT NEW YORK 
Read and clear. 
+ 
2 


FBI(19-cv-1495)-544 


b3 -2 
b7E -3 


be. 1 
bIC -1 


, é FBI(19-cv-1495)-545 


eo 


From: 

To: 

Date: Mon, Sep 8, 2003 9:00 PM 
Subject: Lamo 


| 


i He 
id that be -1 
He appears to consider this a boost to portance. Istill = p7C -1 


think that having him arrested by street cops, and telling him that the FBI was tied up, would be a sweet b7D -1 
blow to his ego. I'm gonna interview my guy tomorrow just to see if Lamo mentioned anything about the 


charges, 
be -1 
b7C -1 


FBI(19-cv-1495)-546 


ALL Ik 
BEREIN 
BATE ¢ 


MATION 
™ 


HIRINED ee -_ is Gy a 


FBI(19-cv-1495)-547 


@ 6 


From: 


To: 

Date: Wed, Oct 1, 2003 7:32 PM 

Subject: Lame - 

a 

Cana myself j fewed who was on the list of people to be interviewed in 
regards to the Lamo case! is writing up me ot the interview, but we wanted to send a brief 
e-mail about th amo connection. 


-_-—_ been datin: ‘also on our list to interview) a few years ago, whom 
fas a hacker] too! herd fret : 
Adrian Lamo through That was the only time| met Lamo. bI7C -3 
During the time o jand| break-up in| 

had _ visite: few times at work. In computer network was 


hacked into by Famo|__en Toned that there was a company memo that was circulated a 


describing the intrusion amo and also in that, Lamo describe 
neard that Lamo was able to break int omputer 
network by} ind obtaining the information. 
[Jno tonger sees [~__Jand does not know his location.or contact information. We are current! 
trying to locate him. It's not clear whethe: may have given Lamo information abou but 
we thought it was coincidental tha! as connected to Lamo through 


as hacked inte by Lamo. 


You may already have the__Jnformation, but let us know if there is anything you would like us to 
follow up on our end. 


Thanks, 


L] be “1 
b7C -1 


FBI(19-cv-1495)-548 


b3 -2 


b7E -3 
ALL INFORMATION z 
SEREIN IS UNTIL b6 -1 
SAIE 02-27 b7C -1 


FBI(19-cv-1495)-549 


: e e 


ne Page ty 


From 

To: 

Date: Fri, Oct 3, 2003 3:50 PM b6 -1 
Subject: Source FD-302 re Adrian Lamo p7c -1 


= 


Ref our telcal on or about 09/25/03 re leads set to WFO to interview individuals relating to the Adrian 
Lamo matter, attached is an electronic copy of source FD-302 re his/her knowledge of Lamo. The 
hardcopy with your file number js being rou will hopefully arrive sometimes later. Pis call if you have any 
questions. 


[ei] 


S 


- yberCrime/NVRA/WE 
esk beé -1 ' 
quad p7c -1 


ell 


‘ax 


be -1 
bie SL 


FBI(19-cv-1495)-550 


ALL INFORMATION 
SEREIN IS UNTIL 


SAIE O2-27 


b3 -2 
b7E -3 


bo -1 
b7C -1 


bool 
D7 Es FHl 


FBI(19-cv-1495)-554 


Sot Slain 


REIN I5 UNCLA 


PATE 9Z- 
From: 
To: Bs 
Date: Fri, Oct 10, 2003 1:55 PM b6 1 
Subject: Re: Hello and question bie 1 
hey 


if you are referring to the time someone from SBC called asking about a screen shot of a TIKI order 

Lamo may have seen. Unfortunately, | did not do a 302 on it. Actually, my oh ae 

the only one communicating with him. | think he talked to him only a couple of times, the last time 

informing him that it was related to the first and only incident. however, |'ll have to confer with[___Jon 

this, | can't remember exactly everything that happened. btw, he's out today. i 


hit me up on the nextel if you have more questions, or want me to get more details and write a 302. 


-skl 


>>: 0/10 9:58 AM >>> bo. 15 

Hi DIC AP AS 
\ 

How are you doing? Well things here are crazy with this case but it looks like he may be taking a plea. 1 

will know more next week. We are shooting for him te do at least 5 years he is only arguing with the 


amount of damages not the actual hacks so we will see what happens. 


| was wondering if you did a 302 of your conversation with SBC communcations. | may need it in case 
tomthe[__—=édiass to testify. Just let me know. 


| hope all is well with you and thank you again for all your great help}! 


a 


FBI(19-cv-1495)-552 


ALL INFORMATION 
SEREIN IS UNTIL 


NED 


SIE O2-27 


bé -1 


b7IC 


-1 


FBI(19-cv-1495)-553 


Source ro ‘Adianlano....... 


From: - 

To: b6 -1, -5 
Subject: Re: Source FD-302 re Adrian Lamo b7Cc -1, -5 
Thanks so much for this information. It is very helpful. Thi he is speaking about is 

His contact info i (don't know much else about him. 


Not sure if this is helpful, hopefully it is. 


Thanks Saain 
a 3:50 PM >>> 


Ref our telcal on or about 09/25/03 re leads set to WFO to interview individuals relating to the Adrian 
Lamo matter, attached is an electronic copy of source FD-302 re his/her knowledge of Lamo. The 
hardcopy with your file number is being rou will hopefully arrive sometimes later, Pls call if you have any 
questions. 


b6 -1 
Squad CRETE (CyberCrimey/NVRAWE bTC -1 
Desk 
Squad 
Cell 
Fax 


ALL INFORMATION ©: RAINES 


FBI(19-cv-1495)-554 
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FEDERAL BUREAU OF INVESTIGATION 


Date of transcription 09/10/2003 


date of birth 
address of 
telephone number 

was interviewed at the office of the FBI. After 
being advised of the identi of the interviewing Agent and the b6 -6 
nature of the Sty [eal eeorided the following information:p7c -6 


related that he met Adrian Lamo, [_SsesSO—O—_] 


amo in person @ 
After the 
encounter at the they continued to meet in 
person, on the phone, and through the Internet.[__ ]described 
Lamo as irrational, but very intelligent, also detached, who 
thrives on attention, but is non-violent. ==] stated that if 
Lamo did something it usually was for a good reason and not just 
for the sake of doing it. 


September 10, 2003, 
social security number 


Lamo, when he called or came_in person to[__Jonly 
dealt with[_ Jand not_his family. has continued his 
contact with Lamo on a when he talked to 
Lamo, it was social and general conversation, he did not talk to 
Lamo about computers or related information because Lamo'’s 
knowledge of computers and_associated topics was wel 


head. The last time_that| was with Lamo was in 
Lamo_ came to staying at 
The last 
communicated with Lamo_was over the Internet at the be -6 


theL——S.E_—_—saidibelieved that Lamo was staying with his b7C -6 
parents in Sacramento, California. Lamo never volunteered to talk 
tof Jabout his exploits on the Internet. 


recalls that Lamo was living in San Francisco with 
his parents when he first met him, and he had a full time job 
having something to do with legal work. As far as friends, 
could only remember only one, a who is 


Investigation on 09/10/2003 at_Reno, Nevada 
2° SRS D3 2 ate dictated 09/10/2003 
DIE -3 


St F117 1485)-55 


b7C -1 


This document contains neither recommendations nor conclusions of the FBI. it_is the property of the FBI and is loaned to your agency; 
it and its contents are not to be distributed outside your agency. 
55683.03 


FD-3022 (Rev. 10-6-95) e 
b7E -3 


Maes. —— <<] on 09/10/2003 Page 2 


| Lamo accessed the Internet through a wireless laptop as 
| far as[. _] knew. [____] denied that Lamo ever used his Internet ,¢ _ 

: bo -5 
access or computer and stated that he had a private network. p7c —-5 


Lamo stayed at residence at 
for approximately 
could not recall Lamo using his telephone at his residence, 


nor asking him to use it. communicated with Lamo using 


“instant messaging," using _ Internet address Adrian@Adrian.Org . 
recalled that he first met Lamo acme anaes 
" he was unable to recall Lamo's,screen names because 
he used numerous. 


volunteered that he is a 
and also works at the b6 -5 
described Lamo as p7c -5 
eccentric, and believed he was sustained by his parents' generosity 
because, though not lacking money, he did seem to have limited 
funds when he visited 


Lamo, as far as a frequented Sacramento and 
San Francisco, California, as well as the state of Virginia, the 
home of AOL. Lamo had a personal dislike for AOL because he had 
worked as a "Community Leader" for AOL until he was fired by them. 
said that he use to be interested in computers but now he had 
little interest in them. He considered his computer abilities at 
better then average, and he had done 
Ce bo -3, -5 


: : eaten She a : DAG 235055) 
When provided a list of ciated with 


and 
as unable to provide any more additional 


information related to Lamo at this time. 


FBI(19-cv-1495)-556 
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Lie 
FEDERAL BUREAU OF INVESTIGATION 


Date of transcription 09/12/2003 


social 


has been the 
ast twenty years. After 
being advised of the identity of the interviewing Agent and the 
nature of the interview provided the following information: 
L] B6 -2, -5 
[____|statea that he had no knowledge of anyone named b7C -2, -5 
xd of Lexis Nexis aia say that 
which he uses. He 


He volunteered that his e-mail address was 


CL Jreiatea that _he had recentl urchased a new system that was 
GeEup by a from =) eR) 
said that had told him that 


when he was transferring information from his old system to his new 
one, he had_ said “someone has been screwing around with your 
computer.” was unable to provided any further pertinent 


information. was asked if he had any objections to writer 
contacting at [-—___ responded yes. 
was contacted atl ——S—S—S—™—sd anna advised thab6 -2, -5 


had volunteered his name as the person that had installed b7C -2, -5 
new computer system. said he also had never_heard of Adrian 
Lamo, nor Lexis /Ne: but he did recall tellin that his 


latous volunteered that had him clean out 
his computer ever six months or so, and finds cookies from 
free porn sites in the system, that is the way gets things 


stuck in his system. He oe ee after cleaning the system 
out, that he should not go to those free sites, because that is how 
his system gets full of junk, but[(__——s—CCCCC#Cj©1d/@ «itt was 
hard to get him to understand. 


Investigation on 09/11/2003 a Reno, Nevada 


me (ean 


by SA 


This document contains neither recommendations nor CO 7C — ihe FBI It is the property of the FBI and is toaned to your agency; 
it and its contents are not to be distributed outside your agency. 
SSELY.OB , 


Date dictated 09/12/2003 
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FD-302 (Rev. 10-6-95) 


FEDERAL BUREAU OF INVESTIGATION 


Date of transcription 10/14/2003 


b6 -5 
On October 10 DP) date of birth DIC -5 
residence address of 
contacted writer telephonica owing 


information: 


absolutely no knowledge of Adrian Lamo, beyond what read in 
the newspaper. 


Investigation on 10/10/03 at Reno, NV 

File # chao Date dictated 10/14/03 

w_sa[ bs 1 eae 
bic lod 


This document contains neither recommendations nor conclusions of the FBI. It is the property + 
it and its contents are not to be distributed outside your agency. 
S567/).03 


(Rey, 01-31-2003) 


® be -1 


£ G2-27-291¢6 ho BAWSTH/RYS 
b7C -1 
FEDERAL BUREAU OF INVESTIGATION 
Precedence: ROUTINE ~ Dates 10/14/2003 
To: New York Attn: SA b6 
Squad DT-5 b7C 
From: Las Vegas 
Squad - 7 
prafted By: [out 


b7E 
Title: ADRIAN LAMO 

NEW YORK TIMES - VICTIM; 

COMPUTER INTRUSION; 

co : NY 


Synopsis: Conducted logical interviews. 


Enclosure(s): Copy of three FD-302s, dated 09/10/2003, b6 -2, -5 
09/11/2003, and 10/10/2003, with results of interviews. b7C -2, -5 


Details: i amo 
approximately They 
later met in person at a see 
FD-302 for details. 

had no knowledge of anyone named 


Adrian Lamo and had never heard of Lexis/Nexis, even though his 
computer was used to access Lexis/Nexis, see FD-302 for details. 


CO advised that he did not know anyone 


named Adrian Lamo, except for reading in the newspaper about him, 
see FD-302 for details. 


JAIL 2 6 2004 


Fbl — NEW YORK 


FBI(19-cv-1495)-559 


To: New York ® Las Vegas 
ne: 10/14/2003 


LEAD (s): 
Set Lead 1: (Info) 
NEW YORK 
AT NEW YORK, NEW YORK 
Read and Clear. 
+ 
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FEDERAL BUREAU OF INVESTIGATION 


Date of transcription 09/26/2003 


date of birth social security number home 
telephone number was interviewed at One Justice Way, 


Dallas, TX. After being advised of the purpose of the interview and 
the identity of the interviewing SecnesL= = dprevided the 
following information: b6 -5 


‘ DYE AS 
does not know anyone by the name of either =) 
idelan cane OE (ane exits oF 


rked as_a_ personal assistant to 


| 
He RESTA CUS ¥ worked as 


=) 
biG =3% oS 
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FEDERAL BUREAU OF INVESTIGATION 


Date of transcription 10/10/2003 


date 
of birth social security number was 


interviewed at her residence. After being advised of the purpose of 
the interview and the identity of the interviewing agent, Do] 
provided the following information: 


Adrian Lamo is the bo -5 
CL _Jhas not seen him since he was five years old. b7c -5 
occasionally talked with Adrian Lamo on the phone but they were 
always very brief conversations and he never talked about any 


computer intrusions. She would talk with[[_—Jeoncerning 
Adrian Lamo. 


[[Jéescribes Adrian Lamo as a good, intelligent person 
who wants to show the world what he can do. He is very independent 
and wants to do things to help people and companies. He does not 
care about money, does not brag about what he does to be 
his own boss. Adrian Lamo_got along very well fe sen Se . 
aid not get along with Adrian Lamo b6 -5 
currently lives wit. 
supported[__—s| Financia ye 


She recalls Adrian Lamo working for a company to help 
them with security issues but does not remember the name of the 
company. She does not know how he accessed the internet and does 
not know any of his friends. He never conversed with her via chats 
or email on the internet. 


[]knew that Adrian Lamo visited San Francisco, 
Sacramento, and Washington DC. He had alot of friends in Washington 
DC. The family used to live in Washington DC. b6 -3 . 

O TD, TSO 


[i ]works as af bic -3, -5 


does not know anyone by the names: 


Investigation on 10/9/03 at Dallas, TX 
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bIE -3 
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FEDERAL BUREAU OF INVESTIGATION 


Date of transcription 09/19/2003 
date of 


birth mobile telephone number was 
interviewed at his residence. After being advised of the purpose of 

the interview and the identity of the interviewing agent, | 
provided the following information: 


does not know anyone_by the name of Adrian Lamo.p¢g —5 

recalls that_in August, 2002 ana@ several bye -5 

current and former were served with a 
lawsuit from 


reviously ran a company called 
was 50% owned b 
arged with 


b7C -1 
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ev. 01-31-2003) 


FEDERAL BUREAU OF INVESTIGATION bic -1 


Precedence: ROUTINE Date: 10/10/2003 


To: New York Attn: DT- 
SA 


From: Dallas 
Cyber 


bo -1 
Approved By: — b7e =1 


Drafted By: 


Title: ADRIAN LAMO; 
New York Times-Victim; 
Computer Intrusion; 


00: NY b3 -2 . ? 
Synopsis: New York Lead Covered : 


References[ 


Enclosure(s): Enclosed for New York Office: 


(a) Original FD-302 regarding interview of 
(2) Original FD-302 regarding interview of 
{3} Original FD-302 regarding interview of 


Details: On 10/9/03, L___was interviewed in reference to 
captioned case. [Jf Adrian Lano. 


on 9/5/03, was interviewed in reference 
to captioned case. for b6é -5 
Co did not know anyone by the name of Adrian Lamo. . 


bIC -5 


On 9/26/03, 
veference to captioned case. 
name of either Adrian Lamo or 
the ex-wife of 
the 


as interviewed in 
did not know anyone by the 


She is believed to be residing in 
area. 


Dallas FBI considers this lead covered. 


b3 -2 
bIE -3 wih Reg 
be -l 
7 , dail 2 6 2004 \ 
LBAD/AS SIGN /COVERED pret € FBL— NEW YORK 
pari" </26 Jor = 
a a 


FBI(19-cv-1495)-564 


To: New York ® Dallas 
pe peers 


LEAD (s): 
Set Lead 1: (Info) 
NEW YORK 
AT NEW YORK, NY 


Read and Clear 


+? 


FBI(19-cv-1495)-565 


ALL INF 
SEREIN IS UNTIL 


SAIE O2-27 


e . 


FBI(19-cv-1495)-566 


e 


pé -1 
iL] bie 1 


tam sorry about the meeting today, | got your message about rescheduling to tomorrow. 
Unfortunately | have another business commitment tomorrow and therefore will not be able to 
attend the meeting. If you would still ike me at the meeting, | will be available Friday after 
12:00pm. | am confused as to the purpose of this meeting. | understand it is to go over the 
particulars of the expenses associated with Lamo’s alleged unauthorized intrusions but can’t an 
agreement be worked out with his attorney to plea to two of the intrusions and an agreement on 
the amount between $100,000 to 200,000 (I think that is the range we discussed when we were 
in your office.) be reached. Even if we just give a general figure of $25,000 for each victim with 
his number of victims it will be over $100,000. 


We have sent the memo to cease the rest of the interviews involved in the investigation with the 
understanding that there are current plea negotiations. If a plea agreement is not reached, 
prudent investigative steps indicate that these interviews are necessary and they will be 
conducted at such time. 


‘Thanks for ail your help with this matter. @ 


SA 
EBI, New York Office 


bo -1 
b7c -1 


ALL INFORMATICN 


be -1 
b7c -1 
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FD-302 (Rev. 10-695) 


FEDERAL BOREAU OF INVESTIGATION 


Date of transcription’ 10/08/2003 


social security account number [___] 
resides at telephone 
numbe: is a journalist for After 


being advised of the identity of the interviewing Agent and the b6 -5 
nature of the interview, [[__]furnished the following b7c -5 
information: 


contacted ADRIAN LAMO, telephonically, for the 
purpose of writing an article for 


(C Jadvised that any further inquiries regarding hi 
contact with LAMO must first be approved by pe eee) 
Co) soe advised that an e-mail stating the purpose of 


the interview be sent to him and he would forward it on to the 
‘for approval. 


A copy of the e-mail and[____| reply is enclosed in 
an FD-340 for inclusion into the case file. 


b3 -2 

b7E -3 

b6 -1 = 
Pes: SM APR 2.5 2008 }} 


£Qi ~ NEW YORK 


Investigati 2 olulu, Hawaii (telephonically) 
File # a 2 3 Date dictated N/A 


sap I __Fel(s9-ev-1495)-568 


251 pjo of. 202- b7C -1 
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it and its contents are not to be distributed outside your agency. 


FD-302 Rev. 10-6.95) 


FEDERAL BUREAU OF INVESTIGATION 


Date of transcription 10/09/2003 


a white male having_date of birth 
was interviewed at his residence 
home telephone After being 
identity of the interviewing agent and the parane cor: 


of t 
the interview,[_] provided the following information: z “2 
b7E: 3; °=5 


is_the husband of[7 UU] (formerly 
. was advised by his wife yesterday 
) that had been interviewed by 
agents from the Federal Bureau_of Investigation at his residence. 
| * called son 10/06/2003 and related 
that he had been interviewed regarding Adrian Lamo and also learned 
that Lamo had turned himself in to the authorities. . 
ee that he LTRS eProninately three 
years ago and never knew or met Adrian Lamo._ His knowledge of Lamo 
is based solely on information learned a 
Li Jexpiained that was currently at work and woul 


return home after 9:00 PM. ch_ailowed Saf contacted 


(Ft her place of employment which allowed SA to schedule 
a time to speak with her on 10/08/2003. 


related that he and are employed at the 
located in is 
is wife works within several of the 


DEAS A348 
bIC-S1,- -3}) 5 
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